ELK 連接 MySQL. 使用 Docker Container 建立 ELK
By: Chung-Chun Lo
Tags: MySQL, Linux, Elk, Docker

這次為了某些需求需要使用 Docker 建立一套 ELK ，但上網爬文的結果大多都是以 Docker Compose 的方式建立，礙於公司某些限制我沒辦法使用 Docker Compose ，所以將這次的建立流程記錄下來以防日後忘記。

Docker image download

這次使用的是 7.9.3 的版本，所以先將需要的 Image pull 下來。

$ docker pull docker.elastic.co/elasticsearch/elasticsearch:7.9.3

$ docker pull docker.elastic.co/logstash/logstash:7.9.3

$ docker pull docker.elastic.co/kibana/kibana:7.9.3

Elasticsearch

由於資安規定 Elasticsearch 必須要有認證機制，所以我們需要先把 Elasticsearch 的憑證生出來。

先建立一個產出憑證用的 Elasticsearch

$ docker run -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" --name es -d docker.elastic.co/elasticsearch/elasticsearch:7.9.3 #啟動elasticsearch並且設定為單一主機模式 $ docker exec -it es /bin/bash #進入該 Container [root@25dee1848472 elasticsearch]# ./bin/elasticsearch-certutil ca

This tool assists you in the generation of X.509 certificates and certificate

signing requests for use with SSL/TLS in the Elastic stack.



The 'ca' mode generates a new 'certificate authority'

This will create a new X.509 certificate and private key that can be used

to sign certificate when running in 'cert' mode.



Use the 'ca-dn' option if you wish to configure the 'distinguished name'

of the certificate authority



By default the 'ca' mode produces a single PKCS#12 output file which holds:

* The CA certificate

* The CA's private key



If you elect to generate PEM format certificates (the -pem option), then the output will

be a zip file containing individual files for the CA certificate and private key



# 輸出檔案位置和密碼皆可空白(直接按Enter)

Please enter the desired output file [elastic-stack-ca.p12]:

Enter password for elastic-stack-ca.p12 :

再生成cert: elastic-certificates.p12

# 輸出檔案位置和密碼皆可空白(直接按Enter)



[root@25dee1848472 elasticsearch]# ./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12

將憑證從container取出，並修改其檔案存取權限記住這點很重要，如果沒有修改權限的話到時 Elasticsearch 會因為無法存取憑證而起動失敗，雖然我也不知道為啥會這樣，但官網教學也是要修改權限。

在將原本的 container 刪除，並使用以下指令建立新的elasticsearch

$ docker run -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" --name es -d -v ~/桌面/Docker/ELK/es/config/elastic-certificates.p12:/usr/share/elasticsearch/config/elastic-certificates.p12 -v ~/桌面/Docker/ELK/es/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml docker.elastic.co/elasticsearch/elasticsearch:7.9.3

container建立起來後進入container內設定密碼

$ docker exec -it es /bin/bash

生成密碼方式有兩種

auto

[root@cfeeab4bb0eb elasticsearch]# ./bin/elasticsearch-setup-passwords -h

Sets the passwords for reserved users



Commands

--------

auto - Uses randomly generated passwords

interactive - Uses passwords entered by a user



Non-option arguments:

command



Option Description

------ -----------

-E <KeyValuePair> Configure a setting

-h, --help Show help

-s, --silent Show minimal output

-v, --verbose Show verbose output







[root@53d04efc3cb4 elasticsearch]# ./bin/elasticsearch-setup-passwords auto

Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.

The passwords will be randomly generated and printed to the console.

Please confirm that you would like to continue [y/N]y





Changed password for user apm_system

PASSWORD apm_system = kve77x0XmSEWZZConMTt



Changed password for user kibana_system

PASSWORD kibana_system = pltXDkjzZrY1344uKavV



# kibana帳號是用來與elasticsearch連接用

Changed password for user kibana

PASSWORD kibana = pltXDkjzZrY1344uKavV



Changed password for user logstash_system

PASSWORD logstash_system = me8rtmiExvXtJBHV3D7e



Changed password for user beats_system

PASSWORD beats_system = ykcw0Q2bNYSqBbJiXAEb



Changed password for user remote_monitoring_user

PASSWORD remote_monitoring_user = SRuY16twbco0ANfGZTYV



# kibana網頁登入使用

Changed password for user elastic

PASSWORD elastic = x8Hbf2RTw0mMhG4xVQEC

2. interactive