pyiteng/elk repository overview

⁠pre-property

# echo "vm.max_map_count = 262144" >> /etc/sysctl.conf
# sysctl -p

⁠拉取镜像

# docker pull pyiteng/elk

⁠启动容器

⁠容器内/var/log/日志收集

# docker run -p 5601:5601 -p 9200:9200 -p 5044:5044 -d \
  --add-host=elk:127.0.0.1 \
  --oom-kill-disable --cpus 2 -m 8g --privileged=true --restart=always \
  --name elk -h elk pyiteng/elk

⁠进入容器配置filebeat.yml

# docker exec -it $container_id bash
# cat > /opt/filebeat/filebeat.yml <<EOF
output:
 logstash:
    enabled: true
  hosts:
   - elk:5044
  timeout: 15
  ssl:
   certificate_authorities:
    - /etc/pki/tls/certs/logstash-beats.crt
filebeat:
 inputs:
  -
   paths:
    - /var/log/kibana/kibana5.log
   tags: syslog
  -
   paths:
    - /opt/log/nginx/*.log
   tags: nginx.log
EOF

⁠重启容器

# docker restart $container_id

⁠注：DockerFile

FROM pyiteng/elk:191226
ENV ES_HEAP_SIZE="2g"
ENV LS_HEAP_SIZE="1g"
EXPOSE 5601 9200 5044
CMD /usr/local/bin/start.sh