docker compose ELK 설치하려다가 실패한 글

 

 

 

1. docker & docker-compose 설치 

잘 설치되었는지 확인 

docker -v 
docker-compose -v

 

2. 컨테이너 설정파일 만들기 (github에서 다운 및 수정) 

https://github.com/deviantony/docker-elk

GitHub - deviantony/docker-elk: The Elastic stack (ELK) powered by Docker and Compose.

 

2-1) docker-compose.yml > ELASTIC_PASSWORD: '비밀번호 수정' 

* 비밀번호는 6자리 이상이여야 한다. (ㅠㅠ) 

    environment:
      ES_JAVA_OPTS: -Xmx256m -Xms256m
      # Bootstrap password.
      # Used to initialize the keystore during the initial startup of
      # Elasticsearch. Ignored on subsequent runs.
      ELASTIC_PASSWORD: changeme

 

 

2-2) .env 

설치할 ELK 버전을 입력한다. 

ELK_VERSION=7.14

 

 

2-3) elasticsearch > config > elasticsearch.yml 

클러스터 이름, 호스트, x-pack관련 내용을 설정한다. 

x-pack 라이센스는 trial(일정 기간 무료) 또는 basic (기본, 무료) 로 선택할 수 있다.

xpack.license.self_generated.type: basic
xpack.security.enabled: true

 

 

2-4) logstash > pipeline > logstash.conf 

codec => json 추가 

	tcp {
		port => 5000
		codec => json
	}

 

 

2-5) logstash > config > logstash.yml 

host명과 x-pack 보안관련 사용자명 추가 & 비밀번호 변경

---
## Default Logstash configuration from Logstash base image.
## https://github.com/elastic/logstash/blob/master/docker/data/logstash/config/logstash-full.yml
#
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: [ "http://elasticsearch:9200" ]

## X-Pack security credentials
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: elastic
xpack.monitoring.elasticsearch.password: changeme

 

 

2-6) kibana/config/kibana.yml 

---
## Default Kibana configuration from Kibana base image.
## https://github.com/elastic/kibana/blob/master/src/dev/build/tasks/os_packages/docker_generator/templates/kibana_yml.template.ts
#
server.name: kibana
server.host: 0.0.0.0
elasticsearch.hosts: [ "http://elasticsearch:9200" ]
monitoring.ui.container.elasticsearch.enabled: true

## X-Pack security credentials
#
elasticsearch.username: elastic
elasticsearch.password: changeme

 

 

2-7) 기본설정 완료되었으면 최상단 폴더에서 아래 명령어 실행

docker-compose up

 

❗️ 만약 port 5000 ERROR가 뜬다면 👇 

https://blckchainetc.tistory.com/390

ERROR: for docker-elk-main_logstash_1 Cannot start service logstash: Ports are not available: listen tcp 0.0.0.0:5000: bind: ad

 

❗️ docker-elk-main_kibana_1 exited with code 78 ERROR가 떴다. 

 

 

 

 

2-8) ELK 컨테이너가 모두 on 된 이후

 

http://localhost:9200 에 접속

하게되면 아까 위의 설정에서 수정한 id / pw를 입력하기 

-> 브라우저 상에 json 파일이 나타난다. 

{
  "name" : "50b4a2c",
  "cluster_name" : "docker-cluster",
  "cluster_uuid" : "WTQ",
  "version" : {
    "number" : "8.1.2",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "316aa7f2b4c1",
    "build_date" : "2022-03-29T21:18:58Z",
    "build_snapshot" : false,
    "lucene_version" : "9.0.0",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

 

http://localhost:5601 접속해보기 

 

브라우저에 아래 에러가 떴다. 

❗️ Kibana server is not ready yet. 

 

1) container ID 확인하기

docker ps -a 

2) error log 확인하기

docker logs <kibana container ID>

3) service token을 사용하라고 한다. 

 

4) service token 생성 

* service token은 유효기간이 없어서 없애고 싶으면 직접 delete를 해주어야 한다. 

curl -X POST "localhost:9200/_security/service/elastic/fleet-server/credential/token/token1?pretty" --user <ID>:<PW>

 

5) service token으로 인증하기 

curl -H "Authorization: Bearer <Token String Value>" http://localhost:9200/_security/_authenticate

 

 

 

 

 

---

 

다시 해보기 

 

 

1. git 다운 

 

 

2. 수정하기 

 

 

2-1) elasticsearch > config > elasticsearch.yml 

* xpack 사용안하므로 삭제 

---
## Default Elasticsearch configuration from Elasticsearch base image.
## https://github.com/elastic/elasticsearch/blob/master/distribution/docker/src/docker/config/elasticsearch.yml
#
cluster.name: "docker-cluster"
network.host: 0.0.0.0

 

 

2-2) elasticsearch > Dockerfile

한글 분석기 nori 설치 문구 작성

ARG ELASTIC_VERSION

# https://www.docker.elastic.co/
FROM docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION}

# Add your elasticsearch plugins setup here
# Example: RUN elasticsearch-plugin install analysis-icu
RUN elasticsearch-plugin install analysis-nori

 

 

2-3) kibana > config > kibana.yml 

---
## Default Kibana configuration from Kibana base image.
## https://github.com/elastic/kibana/blob/master/src/dev/build/tasks/os_packages/docker_generator/templates/kibana_yml.template.ts
#
server.name: kibana
server.host: "0"
elasticsearch.hosts: [ "http://elasticsearch:9200" ]
monitoring.ui.container.elasticsearch.enabled: true

 

 

2-4) logstash > config > logstash.yml 

---
## Default Logstash configuration from Logstash base image.
## https://github.com/elastic/logstash/blob/master/docker/data/logstash/config/logstash-full.yml
#
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: [ "http://elasticsearch:9200" ]

 

 

2-5) logstash > pipeline > logstash.conf

input {
	tcp {
		port => 5000
	}
}

## Add your filters / logstash plugins configuration here

output {
	elasticsearch {
		hosts => "elasticsearch:9200"
		user => "utan"
		password => "asdfasdf"
	}
}

 

 

2-6) docker-compose.yml 

elastic password 비밀번호 변경

** 6자리 이상

  elasticsearch:
    build:
      context: elasticsearch/
      args:
        ELASTIC_VERSION: ${ELASTIC_VERSION}
    volumes:
      - ./elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro,z
      - elasticsearch:/usr/share/elasticsearch/data:z
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      ES_JAVA_OPTS: -Xmx256m -Xms256m
      # Bootstrap password.
      # Used to initialize the keystore during the initial startup of
      # Elasticsearch. Ignored on subsequent runs.
      ELASTIC_PASSWORD: asdfasdf

 

 

2-7) docker-stack.yml

 

 

2-8) 

 

 

 

 

포기