在 Ubuntu 上搭建 ELK基本使用​

在 Ubuntu 上搭建 ELK，Django 接入 ELK，ELK 的基本使用​

---

1.安装Docker

# 允许apt通过HTTPS使用存储库来安装软件
sudo apt-get install -y apt-transport-https ca-certificates curl gnupg-agent software-properties-common

# 添加Docker官方 GPG 密钥
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

# 使用下面的命令去设置稳定版的存储库
$ sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

# 使用下面的命令去设置稳定版的存储库
sudo apt-get install -y docker-ce docker-ce-cli containerd.io

# 验证Docker
docker -v

2.安装docker-compose

# 运行下面的命令来下载 Docker Compose 当前稳定版本
sudo curl -L "https://github.com/docker/compose/releases/download/v2.11.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose

# 添加权限
sudo chmod +x /usr/local/bin/docker-compose
# 验证安装
docker-compose --version

sudo gedit /etc/docker/daemon.json

{
    "registry-mirrors": [
        "http://f1361db2.m.daocloud.io",
        "https://registry.docker-cn.com",
        "http://hub-mirror.c.163.com",
        "https://kfwkfulq.mirror.aliyuncs.com"
    ]
}

systemctl restart docker

docker-compose up -d

systemctl start docker

docker images

mkdir -p ~/projects/elk/{elasticsearch/data,logstash}

cd ~/projects/elk/
ls

sudo touch docker-compose.yaml

sudo gedit  docker-compose.yaml

cd logstash/
ls
sudo gedit logstach.conf

# logstash.conf 文件，放在 projects/elk/logstash 文件夹下
input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4560
    codec => json_lines
  }
}
output {
  elasticsearch {
    hosts => "es:9200"
    index => "logstash-%{+YYYY.MM.dd}"
  }
}

docker-compose -f docker-compose.yaml up -d

docker-compose logs -f logstash