docker-单机ELK-体验

环境：centos7

安装 docker 1.12

安装 1.12之前先把之前docker卸载掉吧，不然后面有可能还是会提示你删除的。

cat > /etc/yum.repos.d/docker.repo <<-EOF
[dockerrepo]
name=Docker Repository
baseurl=https://yum.dockerproject.org/repo/experimental/centos/7/
enabled=1
gpgcheck=1
gpgkey=https://yum.dockerproject.org/gpg
EOF

# yum -y install docker-engine
# systemctl start docker
# docker -v

安装docker-compose

# curl -L https://github.com/docker/compose/releases/download/1.7.1/docker-compose-`uname -s`-`uname -m` > /usr/local/bin/docker-compose
# chmod +x /usr/local/bin/docker-compose
# docker-compose --vesion

直接从 https://github.com/yeasy/docker-compose-files/tree/master/elk_netflow 下载 docker-compose 模板，一键部署并启动。

# cd /opt/
# mkdir -p /opt/data/elasticsearch/
# git clone https://github.com/yeasy/docker-compose-files.git 
# cd /opt/docker-compose-files/elk_netflow
# docker-compose up

# docker ps
CONTAINER ID        IMAGE                     COMMAND                  CREATED             STATUS              PORTS                              NAMES
11aa4e81e594        kibana:4.1                "/docker-entrypoint.s"   2 hours ago         Up 2 hours          0.0.0.0:5601->5601/tcp             elknetflow_kibana_1
986293df6529        yeasy/logstash:1.5        "/docker-entrypoint.s"   2 hours ago         Up 2 hours          0.0.0.0:2055->2055/udp             elknetflow_logstash_1
5e87319a466c        yeasy/elasticsearch:1.7   "/docker-entrypoint.s"   2 hours ago         Up 2 hours          0.0.0.0:9200->9200/tcp, 9300/tcp   elknetflow_elasticsearch_1
b515c6cfbed1        elasticsearch:1.7         "/docker-entrypoint.s"   2 hours ago         Up 2 hours          9200/tcp, 9300/tcp                 elknetflow_es_1

启动后，logstash 将监听本地 2055 端口过来的 netflow 消息；kibana 监听在 5601 端口；elasticsearch 监听在 9200 端口。

浏览器访问 http://servier-IP:5601

屏幕快照 2016-09-22 12.47.38.png