1.拉取镜像

docker pull elasticsearch:7.16.3
docker pull logstash:7.16.3
docker pull kibana:7.16.3

2.ES配置

elasticsearch.yml

http.host: 0.0.0.0
xpack.security.enabled: false
xpack.license.self_generated.type: basic
xpack.security.transport.ssl.enabled: false
network.host: 0.0.0.0

3.logstash配置

logstash.yml

http.host: 0.0.0.0
xpack.monitoring.elasticsearch.hosts: [ "http://es7163:9200" ]

logstash.conf：

input {tcp {mode => "server"host => "0.0.0.0"port => 5044codec => json_lines}
}
filter{}
output {elasticsearch {hosts => "es7163:9200"index => "tingshu-%{+YYYY.MM.dd}"}
}

4.kibana配置

kibana.yml：

server.host: "0.0.0.0"
elasticsearch.hosts: ["http://es7163:9200"]
i18n.locale: "zh-CN"

5.创建自定义网络

docker network create elk

6.docker-compose.yml文件

version: '3'services:elasticsearch:image: elasticsearch:7.16.3container_name: es7163networks:- elkenvironment:- ES_JAVA_OPTS=-Xms1024m -Xmx1024m- discovery.type=single-nodeports:- "9200:9200"- "9300:9300"volumes:- /usr/local/es/data:/usr/share/elasticsearch/data- /usr/local/es/plugins:/usr/share/elasticsearch/plugins- /usr/local/es/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.ymlrestart: alwayslogstash:image: logstash:7.16.3container_name: logstash7163networks:- elkdeploy:resources:limits:cpus: '2'memory: 4gports:- "5044:5044"  # Logstash 默认端口- "9600:9600"volumes:- /usr/local/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml  # 配置文件- /usr/local/logstash/config/logstash.conf:/usr/share/logstash/pipeline/logstash.conf  # 配置文件restart: alwaysdepends_on:- elasticsearchkibana:image: kibana:7.16.3container_name: kibana7163networks:- elkports:- "5601:5601"volumes:- /usr/local/kibana/config/kibana.yml:/usr/share/kibana/config/kibana.ymlrestart: alwaysdepends_on:- elasticsearchnetworks:elk:driver: bridge

7.springboot对接Logstash

1.创建一个springboot项目引入主要依赖

<dependency><groupId>net.logstash.logback</groupId><artifactId>logstash-logback-encoder</artifactId><version>6.6</version>
</dependency>

2.application.yml配置

server:port: 8080
logging:config: classpath:logback-spring.xml
spring:application:name: linging-test

3.resources目录中新增logback-spring.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration><include resource="org/springframework/boot/logging/logback/base.xml" /><springProperty scope="context" name="springAppName" source="spring.application.name"/><springProperty scope="context" name="serverPort" source="server.port"/><appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender"><!--logstash的服务地址和端口，可以实际情况设置--><destination>192.168.159.100:5044</destination><!-- 日志输出编码 --><encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder"><providers><timestamp><timeZone>UTC</timeZone></timestamp><pattern><pattern>{<!--应用名称 -->"app": "${springAppName}_${serverPort}",<!--打印时间 -->"timestamp": "%d{yyyy-MM-dd HH:mm:ss.SSS}",<!--线程名称 -->"thread": "%thread",<!--日志级别 -->"level": "%level",<!--日志名称 -->"logger_name": "%logger",<!--日志信息 -->"message": "%msg",<!--日志堆栈 -->"stack_trace": "%exception"}</pattern></pattern></providers></encoder></appender><!--定义日志文件的存储地址,使用绝对路径--><property name="LOG_HOME" value="/home/logs"/><!-- 按照每天生成日志文件 --><appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender"><rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy"><!--日志文件输出的文件名--><fileNamePattern>${LOG_HOME}/${springAppName}-${serverPort}-%d{yyyy-MM-dd}.log</fileNamePattern></rollingPolicy><encoder><pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern></encoder></appender><root level="INFO"><appender-ref ref="LOGSTASH" /><appender-ref ref="FILE" /><appender-ref ref="CONSOLE" /></root>
</configuration>

4.启动项目，搞点日志

5.进入kibana控制台

6.添加索引模式

7.检索日志，打开Discover