1.检查版本

检查当前系统的docker版本

[root@node1 ~]# docker version
Client: Docker Engine - Community
 Version:           20.10.12
 API version:       1.41
 Go version:        go1.16.12
 Git commit:        e91ed57
 Built:             Mon Dec 13 11:45:41 2021
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.12
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.16.12
  Git commit:       459d0df
  Built:            Mon Dec 13 11:44:05 2021
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.4.12
  GitCommit:        7b11cfaabd73bb80907dd23182b9347b4245eb5d
 runc:
  Version:          1.0.2
  GitCommit:        v1.0.2-0-g52b36a2
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
您在 /var/spool/mail/root 中有新邮件

检查docker compose版本

检查本机docker compose版本

[root@node1 ~]# docker-compose version
docker-compose version 1.29.2, build 5becea4c
docker-py version: 5.0.0
CPython version: 3.7.10
OpenSSL version: OpenSSL 1.1.0l  10 Sep 2019
[root@node1 ~]# 

2.下载相关镜像

下载elasticsearch:7.17.5镜像

docker pull docker.elastic.co/elasticsearch/elasticsearch:7.17.5

下载dkibana:7.17.5镜像

docker pull docker.elastic.co/kibana/kibana:7.17.5

查看镜像

[root@node1 ~]#  docker images 
REPOSITORY                                      TAG       IMAGE ID       CREATED         SIZE

docker.elastic.co/elasticsearch/elasticsearch   7.17.5    11df7a62573d   2 years ago     610MB
docker.elastic.co/kibana/kibana                 7.17.5    5756b819359b   2 years ago     802MB

3.部署EFK系统

创建部署及数据目录

mkdir -p home/docker-EFK/efk/es/data
chmod -R 666 /home/docker-EFK/

编辑filebeat.yaml文件

编辑filebeat.yaml配置文件，方便filebeat容器启动时使用。如果不创建filebeat容器就不用创建这个文件了

[root@node1 efk]# cat filebeat.yaml 
filebeat.inputs:
- type: log
  paths: 
    - '/usr/share/filebeat/logs/*'

processors:
- decode_json_fields:
    fields: ["message"]
    target: ""
    overwrite_keys: true

output.elasticsearch:
  hosts: ["http://10.23.3.2:9200"]
  indices:
    - index: "filebeat-%{+yyyy.MM.dd}"
#    - index: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"
#  username: '...'
#  password: '...'
setup.kibana:
  host: "http://10.23.3.2:5601"

#output.console:
#  enabled: true
#  codec.json:
#    pretty: true
#    #escape_html: false

logging.json: true
logging.metrics.enabled: false
[root@node1 efk]# pwd
/home/docker-EFK/efk
[root@node1 efk]# 

编辑docker-compose.yaml文件

[root@node1 docker-EFK]# pwd
/home/docker-EFK
[root@node1 docker-EFK]# cat docker-compose.yaml 
version: '3.3'

services:

  elasticsearch:
    image: "docker.elastic.co/elasticsearch/elasticsearch:7.17.5"
    container_name: elasticsearch
    restart: always
    environment:
    - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    - "discovery.type=single-node"
    - "cluster.name=myes"
    - "node.name=jeven"
    # - xpack.security.enabled: "false"
    ulimits:
      memlock:
        soft: -1
        hard: -1 
    networks:
      myefk:
        ipv4_address: 172.29.120.10
        aliases:
        - es
        - jeven
    ports:
    - "9200:9200"
    - "9300:9300"
    volumes:
    - /home/docker-EFK/efk/es/data/:/usr/share/elasticsearch/data

  kibana:
    image: "docker.elastic.co/kibana/kibana:7.17.5"
    restart: always
    environment:
      ELASTICSEARCH_URL: http://10.23.3.2:9200
      ELASTICSEARCH_HOSTS: '["http:/10.23.3.2:9200"]'
      I18N_LOCALE: zh-CN
    networks:
      myefk:
        ipv4_address: 172.29.120.20
        aliases:
          - kibana
          - kib
    ports:
    - "5601:5601"
    links:
    - "elasticsearch"

  filebeat:
    image: "docker.elastic.co/beats/filebeat:7.17.5"
    restart: always
    networks:
      myefk:
        ipv4_address: 172.29.120.30
        aliases:
          - filebeat
          - fb
    user: root
    command: ["--strict.perms=false"]
    volumes:
    - /home/docker-EFK/efk/filebeat.yaml:/usr/share/filebeat/filebeat.yml
    - /var/lib/docker:/var/lib/docker:ro
    - /var/run/docker.sock:/var/run/docker.sock
    links:
    - "elasticsearch"
    - "kibana"


networks:
  myefk:
    driver: bridge
    ipam:
      config:
        - subnet: 172.29.120.0/24
[root@node1 docker-EFK]# 

部署EFK

执行docker compose up -d ，开始部署efk

报错，accessdeny*** 将chmod 777 /home/docker-EFK/efk/es/data/ 后问题解决

检查efk相关容器状态

检查efk的相关容器启动状态

代码语言：shell

复制

[root@jeven efk]# docker compose ps
NAME                COMMAND                  SERVICE             STATUS              PORTS
efk-filebeat-1      "/usr/bin/tini -- /u…"   filebeat            running             
efk-kibana-1        "/bin/tini -- /usr/l…"   kibana              running             0.0.0.0:5601->5601/tcp, :::5601->5601/tcp
elasticsearch       "/bin/tini -- /usr/l…"   elasticsearch       running          

或者

[root@node1 efk]# docker-compose ps
        Name                       Command               State                                         Ports                                       
---------------------------------------------------------------------------------------------------------------------------------------------------
docker-efk_filebeat_1   /usr/bin/tini -- /usr/loca ...   Up                                                                                        
docker-efk_kibana_1     /bin/tini -- /usr/local/bi ...   Up      0.0.0.0:5601->5601/tcp,:::5601->5601/tcp                                          
elasticsearch           /bin/tini -- /usr/local/bi ...   Up      0.0.0.0:9200->9200/tcp,:::9200->9200/tcp, 0.0.0.0:9300->9300/tcp,:::9300->9300/tcp
[root@node1 efk]# 

访问kibana服务

1.访问kibana

浏览器输入：http://10.23.3.2:5601/

查看日志信息

1.进入索引管理界面

选择managerment——stack managerment，索引管理

查看filebeat索引信息

选择filebeat索引，查看索引信息。

创建索引

进入索引管理界面，选择索引模式——创建索引，

设置索引名称——索引时间戳字段——创建索引。

搜索日志信息

在主页，选择discover模块位置，根据字段可搜索日志信息。

查看日志文件信息

Observability——日志，点击进入。