---

一.安裝ELK 7.17

不要一股腦執(zhí)行以下語句,請觀察修改要修改的地方

安裝logstash

# logstash安裝docker run -d --name logstash \-p 5043:5043 -p 5044:5044  --privileged=true \-v /mydata/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf \-v /mydata/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml \logstash:7.17.3

elasticsearch

# 安裝es
docker pull elasticsearch:7.17.3
mkdir -p /mydata/elasticsearch/config
mkdir -p /mydata/elasticsearch/data
echo "http.host: 0.0.0.0" >> /mydata/elasticsearch/config/elasticsearch.yml
chmod -R 777 /mydata/elasticsearch/docker run --name elasticsearch -p 9200:9200 -p 9300:9300 \
-e "discovery.type=single-node" \
-e ES_JAVA_OPTS="-Xms512m -Xmx512m" \
--restart=always --privileged=true \
-v /mydata/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
-v /mydata/elasticsearch/data:/usr/share/elasticsearch/data \
-v /mydata/elasticsearch/plugins:/usr/share/elasticsearch/plugins \
-d elasticsearch:7.17.3

kibana

# 安裝es可視化工具kibana
docker pull kibana:7.17.3# ELASTICSEARCH_HOSTS=http://本機ip:9200
docker run --name kibana -e ELASTICSEARCH_HOSTS=http://192.168.56.101:9200 -p 5601:5601 \
--restart=always --privileged=true -d kibana:7.17.3

注意給logstash,elasticsearch,kibana釋放端口,云服務(wù)器提供商和系統(tǒng)的端口
訪問 http://ip:9200,http://ip:5601看es,kibana是否安裝完成

---

二.為Elasticsearch設(shè)置密碼

2.1進入到es掛載目錄elasticsearch.yml的掛載目錄，添加以下內(nèi)容

http.host: 0.0.0.0
http.cors.enabled: true
http.cors.allow-origin: "*"
http.cors.allow-headers: Authorization
xpack.security.enabled: true
# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl.enabled: true
# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl.enabled: false

2.重啟es容器并進入es容器
3.進入容器后執(zhí)行以下命令 傻瓜式設(shè)置賬號密碼

./bin/elasticsearch-setup-passwords interactive

4.重啟es容器

---

三.配置logstash

3.1 進入logstash容器執(zhí)行以下命令:

docker exec -it logstash /bin/bash/usr/share/logstash/bin/logstash-plugin install logstash-codec-json_lines

3.2 重啟logstash
3.3 進入logstash容器的掛載目錄logstash.conf

input {stdin { }tcp {mode => "server"host => "0.0.0.0"port => 5043codec => json_lines}
}output {stdout {codec => rubydebug}elasticsearch {hosts => "192.168.1.1:9200"index => "springboot-%{+YYYY.MM.dd}"user => "username"password => "password"}
}

這里認證明文不安全.可以參考如下鏈接: 密文

四.springboot整合logstash

1.pom.xml

<dependency><groupId>ch.qos.logback</groupId><artifactId>logback-classic</artifactId>
</dependency>
<dependency><groupId>net.logstash.logback</groupId><artifactId>logstash-logback-encoder</artifactId><version>7.3</version>
</dependency>

2. application.yml

server:port: 10500spring:profiles:active: devapplication:name: vector-searchthymeleaf:cache: false# jackson時間格式化jackson:time-zone: GMT+8# elasticsearchdate-format: yyyy-MM-dd HH:mm:sslogging:level:root: info

3.application-dev.yml

logstash:host: 127.0.0.1port: 5043# 定義日志文件的存儲地址 勿在 LogBack 的配置中使用相對路徑path: /mydata/logstash
es:host: 127.0.0.1port: 9200username: 11111password: 11111

4.在resources文件夾下，創(chuàng)建logback-spring.xml而不是logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration scan="true" scanPeriod="60 seconds" debug="false"><include resource="org/springframework/boot/logging/logback/base.xml"/><include resource="org/springframework/boot/logging/logback/defaults.xml"/><!--獲取springboot的yml配置信息--><springProperty scope="context" name="applicationName" source="spring.application.name" defaultValue="default"/><springProperty scope="context" name="LOGSTASH_HOST" source="logstash.host" defaultValue="default"/><springProperty scope="context" name="LOGSTASH_PORT" source="logstash.port" defaultValue="default"/><springProperty scope="context" name="LOG_HOME" source="logstash.path" defaultValue="default"/><!--輸出到控制臺--><appender name="console" class="ch.qos.logback.core.ConsoleAppender"><filter class="ch.qos.logback.classic.filter.ThresholdFilter"><level>INFO</level></filter><withJansi>false</withJansi><encoder><!--<pattern>%d %p (%file:%line)- %m%n</pattern>--><!--格式化輸出：%d:表示日期    %thread:表示線程名     %-5level:級別從左顯示5個字符寬度  %msg:日志消x`x`息    %n:是換行符--><pattern>%d{yyyy-MM-dd HH:mm:ss} %highlight(%-5level) -- %boldMagenta([%thread]) %boldCyan(%logger) :%msg%n</pattern><charset>UTF-8</charset></encoder></appender><springProfile name="dev,test"><!--  日志發(fā)送至logstash  --><appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender"><destination>${LOGSTASH_HOST:- }:${LOGSTASH_PORT:- }</destination><!-- encoder is required --><encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder"><!-- 在elasticsearch的index中追加applicationName字段  --><customFields>{"applicationName":"${applicationName}"}</customFields></encoder></appender></springProfile><!-- 按照每天生成日志文件 --><appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender"><rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy"><!--日志文件輸出的文件名--><FileNamePattern>${LOG_HOME}/TestWeb.log.%d{yyyy-MM-dd}.log</FileNamePattern><!--日志文件保留天數(shù)--><MaxHistory>30</MaxHistory></rollingPolicy><encoder charset="UTF-8" class="ch.qos.logback.classic.encoder.PatternLayoutEncoder"><!--格式化輸出：%d表示日期，%thread表示線程名，%-5level：級別從左顯示5個字符寬度%msg：日志消息，%n是換行符--><pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{50} - %msg%n</pattern></encoder><!--日志文件最大的大小--><triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy"><MaxFileSize>10MB</MaxFileSize></triggeringPolicy></appender><!-- 日志輸出級別 --><!-- 線上環(huán)境，日志配置 --><springProfile name="prod"><root level="INFO"><appender-ref ref="LOGSTASH"/></root></springProfile><!-- 本地、開發(fā)環(huán)境，日志配置 可以寫logback支持的所有節(jié)點 --><springProfile name="dev,test"><root level="INFO"><appender-ref ref="LOGSTASH"/><appender-ref ref="console"/></root></springProfile></configuration>

五.spring整合Elastic Search

詳見本篇文章