docker部署es+kibana – linux极客聚集地

docker部署es

配置加速镜像源

[root@localhost elasticsearch]# cat /etc/docker/daemon.json 
{
  "registry-mirrors": [
      "https://docker.1ms.run",
"https://docker.1panel.live",
"https://docker.m.ixdev.cn",
"https://hub.rat.dev",
"https://docker.xuanyuan.me",
"https://dockerproxy.net",
"https://docker.hlmirror.com",
"https://hub1.nat.tf",
"https://hub2.nat.tf",
"https://hub3.nat.tf",
"https://docker.m.daocloud.io",
"https://docker.kejilion.pro",
"https://hub.1panel.dev",
"https://dockerproxy.cool",
"https://docker.apiba.cn",
"https://proxy.vvvv.ee",
"https://docker.fnnas.com"
  ],
 "data-root": "/data/docker"
}

docker compose up -d

.env

# ========================
# 通用配置
# ========================
HOST_IP=192.168.99.80
DATA_DIR=/data
SOFT_DIR=${DATA_DIR}/soft
RESOURCES_DIR=${DATA_DIR}/resources
TIMEZONE=Asia/Shanghai
COMPOSE_PROJECT_NAME=stec-platform-prod
DEPLOY_ENV=prod  # dev/test/staging/prod
# ========================
# 容器名称配置
# ========================
ELASTICSEARCH_CONTAINER_NAME=${COMPOSE_PROJECT_NAME}-${DEPLOY_ENV}-es
# ========================
# 服务端口配置
# ========================
ES_HTTP_PORT=9200
ES_TRANSPORT_PORT=9300
# ========================
# 服务版本配置
# ========================
ES_VERSION=7.17.29
# ========================
# 认证配置
# ========================
# Elasticsearch
ES_PASSWORD=YourSecureESPass123!
ES_JVM_OPTS="-Xms4096m -Xmx4096m"

docker-compse.yml

version: '3.8'

services:
  elasticsearch:
    container_name: ${ELASTICSEARCH_CONTAINER_NAME}
    image: elasticsearch:${ES_VERSION}
    environment:
      - discovery.type=single-node
      - ELASTIC_PASSWORD=${ES_PASSWORD}
      #- ES_JAVA_OPTS=${ES_JVM_OPTS}
      - ES_JAVA_OPTS=-Xms2g -Xmx2g
      - xpack.security.enabled=true
      - TZ=Asia/Shanghai
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    ports:
      - "${ES_HTTP_PORT}:9200"
      - "${ES_TRANSPORT_PORT}:9300"
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./configs/elasticsearch/hosts:/etc/hosts:ro
      - /etc/timezone:/etc/timezone:ro
      - ./configs/elasticsearch/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
      - ./data/elasticsearch/data:/usr/share/elasticsearch/data
      - ./data/elasticsearch/logs:/usr/share/elasticsearch/logs
      - ./data/elasticsearch/snapshots:/usr/share/elasticsearch/snapshots
    restart: always

networks:
  default:
    name: ${DEPLOY_ENV}_network
    driver: bridge

./configs/elasticsearch/elasticsearch.yml

bootstrap.memory_lock: false
bootstrap.system_call_filter: false
node.name: stec-platform-prod-prod-es
network.host: 0.0.0.0
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
path.repo: ["/usr/share/elasticsearch/snapshots"]

./configs/elasticsearch/hosts:

127.0.0.1localhost
::1localhost ip6-localhost ip6-loopback
fe00::0ip6-localnet
ff00::0ip6-mcastprefix
ff02::1ip6-allnodes
ff02::2ip6-allrouters
172.18.0.26fdec2fa9ed7
152.32.137.93 geoip.elastic.co

查看es日志发现故障：

一、启动es后日志报错，geoip数据库更新失败

故障原因：网络问题导致更新失败

解决方案：配置geoip数据库host解析

临时测试：`echo "152.32.137.93 geoip.elastic.co" >> /etc/hosts`

[root@localhost elasticsearch]# docker exec -it stec-platform-prod-prod-es cat /etc/hosts
127.0.0.1localhost
::1localhost ip6-localhost ip6-loopback
fe00::0ip6-localnet
ff00::0ip6-mcastprefix
ff02::1ip6-allnodes
ff02::2ip6-allrouters
172.18.0.26fdec2fa9ed7
152.32.137.93 geoip.elastic.co

永久生效：由于每次重启es容器都会重新加载/etc/hosts文件，所以需要将写好的/etc/hosts挂载进去

    volumes:
      - ./configs/elasticsearch/hosts:/etc/hosts:ro

二、es日志中的时间不对

故障原因：主机时区文件有问题或者没有在docker-compose.yml文件中指定

检查挂载的文件是否有问题

[root@localhost elasticsearch]# ls -l /etc/localtime 
lrwxrwxrwx. 1 root root 35 4月  18 2025 /etc/localtime -> ../usr/share/zoneinfo/Asia/Shanghai
[root@localhost elasticsearch]# ls -l /etc/timezone 
-rw-r--r-- 1 root root 14 11月 17 14:18 /etc/timezone
[root@localhost elasticsearch]# cat /etc/timezone
Asia/Shanghai
[root@localhost elasticsearch]#

解决方案：docker-compose.yml文件中指定时区

   environment:
      - TZ=Asia/Shanghai
   volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro

docker 部署kibana

注意事项：kibana和es是兄弟产品，部署的时候注意必须部署同一版本，或者不能有太大差异

kibana docker镜像下载：https://hub.docker.com/_/kibana

version: '3.8'

services:
  kibana-test:
    container_name: temp-kibana-test
    image: kibana:7.17.28
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=elastic
      - ELASTICSEARCH_PASSWORD=YourSecureESPass123!
      - ELASTICSEARCH_SSL_VERIFICATIONMODE=none
      - SERVER_NAME=kibana-test
      - SERVER_HOST=0.0.0.0
    ports:
      - "5602:5601"
    networks:
      - prod_network
    restart: unless-stopped

networks:
  prod_network:
    external: true
    name: prod_network

kibana使用手册：

https://zhuanlan.zhihu.com/p/622474009