DockerCompose安裝ELK集成鏡像

一、下載ELK鏡像
docker pull sebp/elk

二、修改系統配置

2.1 修改用户可打開的文件句柄數

vim /etc/security/limits.conf

# 在最後面追加下面內容

* soft nproc 65535
* hard nproc 65535
* soft nofile 65535
* hard nofile 65535

# elk hard nofile 65536
# elk soft nofile 65536

可以解決ELK啓動報: ERROR: Elasticsearch did not exit normally - check the logs at /var/log/elasticsearch/elasticsearch.log錯的問題

2.2 更改系統vm.max_map_count設置值

max_map_count文件包含限制一個進程可以擁有的VMA(虛擬內存區域)的數量
這個值需要調大一些
臨時調整: sysctl -w vm.max_map_count=262144
永久調整: vim /etc/sysctl.conf

# 在末尾加上一行
vm.max_map_count=262144

更新配置
sysctl -p

查看更改後的值
sysctl -a | grep vm.max_map_count

# 查看
[root@localhost /]# sysctl -a | grep vm.max_map_count
vm.max_map_count = 262144

調大後可以消除elk啓動時的錯誤: bootstrap check failure [1] of [1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

三、創建容器

3.1 初始化一個容器

先創建一個容器， 以便複製出配置文件

docker-compose.yml文件配置

version: '3'
services:
  elk:
    container_name: elk
    image: sebp/elk
    ports:
      - "5601:5601"
      - "9200:9200"
      - "5044:5044"
    environment:
      - ES_HEAP_SIZE=4g
      - ES_JAVA_OPTS=-Xms16g -Xmx16g
      - ELASTIC_PASSWORD=WhoLWuTong.31
      - xpack.security.enabled=true
      - TZ=Asia/Shanghai

docker-compose up命令啓動

3.2 複製配置文件

從容器中複製出ELK配置

docker cp elk:/var/lib/elasticsearch/ /data/elk/elasticsearch/data
docker cp elk:/etc/elasticsearch/ /data/elk/elasticsearch/config
docker cp elk:/opt/logstash/config /data/elk/logstash/config
docker cp elk:/etc/logstash/conf.d /data/elk/logstash/conf.d
docker cp elk:/opt/kibana/config /data/elk/kibana/config
docker cp elk:/opt/kibana/data /data/elk/kibana/data
mv /data/elk/elasticsearch/config/elasticsearch/* /data/elk/elasticsearch/config
rm -rf /data/elk/elasticsearch/config/elasticsearch/
mv /data/elk/elasticsearch/data/elasticsearch/* /data/elk/elasticsearch/data
rm -rf /data/elk/elasticsearch/data/elasticsearch/

# 複製完成後修改目錄權限
cd /data/elk
chown -R 991:991 elasticsearch*
chown -R 992:992 logstash*
chown -R 993:993 kibana*
# 改日誌目錄權限
#cd /data/elk/log
#chown -R 991:991 elasticsearch*
#chown -R 992:992 logstash*
#chown -R 993:993 kibana*
#chmod 644 -R /data/elk/log

# 刪除容器
docker stop elk
docker rm elk

3.3 修改配置

本機是32G， 給eleasticsearch分一半
vim /data/elk/elasticsearch/config/jvm.options

# 找到
#-Xms4g
#-Xmx4g
# 改為
-Xms16g
-Xmx16g

3.4 啓動一個新的ELK容器

修改docker-compose.yml文件

version: '3'
services:
  elk:
    container_name: elk
    image: sebp/elk
    ports:
      - "5601:5601"
      - "9200:9200"
      - "5044:5044"
    environment:
      - ES_HEAP_SIZE=4g
      - ES_JAVA_OPTS=-Xms16g -Xmx16g
      - ELASTIC_PASSWORD=WhoLWuTong.31
      - xpack.security.enabled=true
      - TZ=Asia/Shanghai
    volumes:
      - /data/elk/logstash/config:/opt/logstash/config
      - /data/elk/logstash/conf.d:/etc/logstash/conf.d
      - /data/elk/elasticsearch/config:/etc/elasticsearch
      - /data/elk/elasticsearch/data:/var/lib/elasticsearch
      - /data/elk/kibana/config:/opt/kibana/config
      - /data/elk/kibana/data:/opt/kibana/data

docker-compose up啓動