docker安装 elasticsearch，filebeat，kibana 日志系统

参考文档

参考：https://github.com/maxyermayank/docker-compose-elasticsearch-kibana/blob/master/docker-compose.yml
参考：https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html
参考：https://github.com/maxyermayank/docker-compose-elasticsearch-kibana/blob/master/docker-compose.yml
#docker网络讲解 https://github.com/deviantony/docker-elk/wiki/External-applications
参考(es镜像列表)：https://www.docker.elastic.co/# 

#Elasticsearch 对各种文件混合使用了 NioFs（ 注：非阻塞文件系统）和 MMapFs （ 注：内存映射文件系统）。请确保你配置的最大映射数量，以便有足够的虚拟内存可用于 mmapped 文件。这可以暂时设置：
sysctl -w vm.max_map_count=262144
或者你可以在 /etc/sysctl.conf 通过修改 vm.max_map_count 永久设置它。

elasticsearch+kibana+headPlugin+filebeat(docker compose)

docker-compose.yml (本地模拟2个es)
version: '2.2'
services:
  es01:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.1.0
    container_name: es01
    environment:
      - node.name=es01
      - discovery.seed_hosts=es02
      - cluster.initial_master_nodes=es01,es02
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - esdata01:/usr/share/elasticsearch/data
    ports:
      - 9200:9200
    networks:
      - esnet
    restart: always
  es02:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.1.0
    container_name: es02
    environment:
      - node.name=es02
      - discovery.seed_hosts=es01
      - cluster.initial_master_nodes=es01,es02
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - esdata02:/usr/share/elasticsearch/data
    networks:
      - esnet
    restart: always
  kibana:
    image: 'docker.elastic.co/kibana/kibana:7.1.0'
    container_name: kibana
    hostname: kibana
    restart: always
    environment:
      SERVER_NAME: localhost
      ELASTICSEARCH_HOSTS: http://es01:9200/
    ports:
      - '5601:5601'
    networks:
      - esnet
  cerebro:
    image: yannart/cerebro
    ports:
      - "9002:9000"
    networks:
      - esnet
  filebeat:
    image: docker.elastic.co/beats/filebeat:7.1.0
    command: --strict.perms=false
    environment:
      - setup.kibana.host=kibana:5601
      - output.elasticsearch.hosts=["http://127.0.0.1:9200"]
    ports:
      - 9001:9000
    volumes:
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - esnet
    restart: always
  logstash:
    image: docker.elastic.co/logstash/logstash:7.1.0
    container_name: logstash
    ports:
      - "5044:5044"
      - "9600:9600"
    networks:
      - esnet
volumes:
  esdata01:
    driver: local
  esdata02:
    driver: local
networks:
  esnet:

#  headPlugin:暂时弃用
    image: 'mobz/elasticsearch-head:5'
    container_name: head
    ports:
      - '9002:9100'
    networks:
      - esnet
    restart: always

启动

#启动
$ docker-compose up
查看docker container
$ docker stats CONTAINERID
#查看 容器日志
$ docker logs -f -t --tail 100 kibana
#如果要用自己的es data
mkdir esdatadir
chmod g+rwx esdatadir
chgrp 1000 esdatadir