当前位置：首页 > news >正文

docker-compose快速部署启动file beat+ELK

news 2025/8/7 6:33:51

1、创建一个脚本文件setup-elk.sh

#!/bin/bash# =================================================================
# ELK Stack 自动化部署脚本 (for Docker Compose)
#
# 功能:
# 1. 创建标准的项目目录结构。
# 2. 自动生成 docker-compose.yml, filebeat.yml, logstash.conf。
# 3. 提供清晰的后续操作指引。
#
# 使用方法:
# 1. chmod +x setup-elk.sh
# 2. ./setup-elk.sh
# =================================================================# 定义颜色常量，让输出更美观
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color# --- 1. 创建项目目录结构 ---
echo -e "${YELLOW}==> 1. Creating project directory structure...${NC}"
PROJECT_DIR="elk-stack"
mkdir -p ${PROJECT_DIR}/{filebeat,logstash/pipeline,logs}
if [ $? -ne 0 ]; thenecho "Error: Failed to create directories."exit 1
fi
echo "    - ${PROJECT_DIR}/"
echo "    - ${PROJECT_DIR}/filebeat/"
echo "    - ${PROJECT_DIR}/logstash/pipeline/"
echo "    - ${PROJECT_DIR}/logs/"
echo -e "${GREEN}Directory structure created successfully.${NC}\n"# 切换到项目目录
cd ${PROJECT_DIR}# --- 2. 创建 docker-compose.yml 文件 ---
echo -e "${YELLOW}==> 2. Creating docker-compose.yml...${NC}"
cat <<EOF > docker-compose.yml
version: '3.8'services:# 1. Elasticsearch: 存储和搜索日志elasticsearch:image: elasticsearch:8.13.4container_name: elasticsearchenvironment:- discovery.type=single-node- xpack.security.enabled=false- "ES_JAVA_OPTS=-Xms512m -Xmx512m"volumes:- esdata:/usr/share/elasticsearch/dataports:- "9200:9200"networks:- elkhealthcheck:test: ["CMD-SHELL", "curl -s http://localhost:9200/_cluster/health | grep -vq '\"status\":\"red\"'"]interval: 10stimeout: 5sretries: 5# 2. Logstash: 处理和转换日志logstash:image: logstash:8.13.4container_name: logstashvolumes:- ./logstash/pipeline/:/usr/share/logstash/pipeline/ports:- "5044:5044"networks:- elkdepends_on:elasticsearch:condition: service_healthy# 3. Kibana: 可视化界面kibana:image: kibana:8.13.4container_name: kibanaenvironment:- ELASTICSEARCH_HOSTS=http://elasticsearch:9200ports:- "5601:5601"networks:- elkdepends_on:elasticsearch:condition: service_healthy# 4. Filebeat: 收集和发送日志文件filebeat:image: elastic/filebeat:8.13.4container_name: filebeatuser: rootvolumes:- ./filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro- ./logs:/var/log/app/:ro- filebeatdata:/usr/share/filebeat/data/networks:- elkdepends_on:- logstashnetworks:elk:driver: bridgevolumes:esdata:driver: localfilebeatdata:driver: local
EOF
echo -e "${GREEN}docker-compose.yml created successfully.${NC}\n"# --- 3. 创建 filebeat.yml 文件 ---
echo -e "${YELLOW}==> 3. Creating filebeat.yml...${NC}"
cat <<EOF > filebeat/filebeat.yml
filebeat.inputs:
- type: logenabled: truepaths:- /var/log/app/*.log output.logstash:hosts: ["logstash:5044"]
EOF
echo -e "${GREEN}filebeat.yml created successfully.${NC}\n"# --- 4. 创建 logstash.conf 文件 ---
echo -e "${YELLOW}==> 4. Creating logstash.conf...${NC}"
cat <<EOF > logstash/pipeline/logstash.conf
input {beats {port => 5044}
}filter {# 在这里添加你的日志解析规则, 例如:# if [message] =~ /^{.*}$/ {#   json {#     source => "message"#   }# }
}output {elasticsearch {hosts => ["http://elasticsearch:9200"]index => "app-logs-%{+YYYY.MM.dd}" }# stdout { codec => rubydebug }
}
EOF
echo -e "${GREEN}logstash.conf created successfully.${NC}\n"# --- 5. 创建示例日志文件 ---
echo -e "${YELLOW}==> 5. Creating a placeholder log file...${NC}"
touch logs/app.log
echo -e "${GREEN}logs/app.log created successfully.${NC}\n"# --- 6. 完成并提供后续指令 ---
echo -e "${GREEN}======================================================"
echo -e "         ELK Stack Setup Completed!        "
echo -e "======================================================${NC}"
echo ""
echo "所有配置文件已在 '${YELLOW}${PROJECT_DIR}${NC}' 目录中生成。"
echo ""
echo -e "下一步操作:"
echo "1. 启动整个日志栈:"
echo -e "   ${YELLOW}cd ${PROJECT_DIR}${NC}"
echo -e "   ${YELLOW}docker-compose up -d${NC}"
echo ""
echo "2. 启动后，您可以向日志文件中写入数据进行测试:"
echo -e "   ${YELLOW}echo '{\"level\":\"INFO\", \"message\":\"This is a test log.\"}' >> logs/app.log${NC}"
echo ""
echo "3. 访问 Kibana 进行查看:"
echo -e "   ${YELLOW}http://<your-server-ip>:5601${NC}"
echo ""
echo "4. 停止服务:"
echo -e "   ${YELLOW}docker-compose down${NC}"
echo ""