# 创建docker-compose.yml文件
$ cat > docker-compose.yml << 'EOF'
version: '3'
services:
  elasticsearch:
    image: elasticsearch:7.17.0
    environment:
      - discovery.type=single-node
    ports:
      - "9200:9200"
    restart: always
  logstash:
    image: logstash:7.17.0
    volumes:
      - ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf
    ports:
      - "5044:5044"
    restart: always
  kibana:
    image: kibana:7.17.0
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    ports:
      - "5601:5601"
    restart: always
EOF

# 创建logstash.conf文件
$ cat > logstash.conf << 'EOF'
input {
  beats {
    port => 5044
  }
  tcp {
    port => 5000
  }
}

filter {
  if [message] =~ /^{4}-{2}-{2}/ {
    grok {
      match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{GREEDYDATA:message}" }
    }
  }
}

output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    index => "docker-logs-%{+YYYY.MM.dd}"
  }
}
EOF

# 启动服务
$ docker-compose up -d

Creating network "docker_default" with the default driver
Creating docker_elasticsearch_1 ... done
Creating docker_logstash_1      ... done
Creating docker_kibana_1        ... done

# 运行容器并发送日志到ELK
$ docker run --name app \
    --log-driver gelf \
    --log-opt gelf-address=udp://localhost:12201 \
    -d \
    nginx:1.24

# 创建alertmanager.yml文件
$ cat > alertmanager.yml << 'EOF'
global:
  resolve_timeout: 5m

route:
  group_by: ['alertname']
  group_wait: 30s
  group_interval: 5m
  repeat_interval: 1h
  receiver: 'email'

receivers:
- name: 'email'
  email_configs:
  - to: 'admin@example.com'
    from: 'alertmanager@example.com'
    smarthost: 'smtp.example.com:587'
    auth_username: 'alertmanager'
    auth_password: 'password'
    require_tls: true
EOF

# 创建alerts.yml文件
$ cat > alerts.yml << 'EOF'
groups:
- name: container_alerts
  rules:
  - alert: ContainerDown
    expr: up == 0
    for: 5m
    labels:
      severity: critical
    annotations:
      summary: "Container down"
      description: "Container {{ $labels.instance }} has been down for 5 minutes."
  - alert: ContainerHighCPU
    expr: container_cpu_usage_seconds_total{name!=""} > 0.8
    for: 5m
    labels:
      severity: warning
    annotations:
      summary: "High CPU usage"
      description: "Container {{ $labels.name }} has been using more than 80% CPU for 5 minutes."
  - alert: ContainerHighMemory
    expr: container_memory_usage_bytes{name!=""} > 0.8 * container_spec_memory_limit_bytes{name!=""}
    for: 5m
    labels:
      severity: warning
    annotations:
      summary: "High memory usage"
      description: "Container {{ $labels.name }} has been using more than 80% memory for 5 minutes."
EOF

# 更新prometheus.yml文件
$ cat > prometheus.yml << 'EOF'
global:
  scrape_interval: 15s
  evaluation_interval: 15s

rule_files:
  - "alerts.yml"

scrape_configs:
  - job_name: 'cadvisor'
    static_configs:
      - targets: ['cadvisor:8080']

alerting:
  alertmanagers:
  - static_configs:
    - targets: ['alertmanager:9093']
EOF

# 更新docker-compose.yml文件
$ cat > docker-compose.yml << 'EOF'
version: '3'
services:
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    restart: always
  prometheus:
    image: prom/prometheus:latest
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - ./alerts.yml:/etc/prometheus/alerts.yml
    restart: always
  alertmanager:
    image: prom/alertmanager:latest
    volumes:
      - ./alertmanager.yml:/etc/alertmanager/alertmanager.yml
    ports:
      - "9093:9093"
    restart: always
  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    restart: always
EOF

# 启动服务
$ docker-compose up -d

Creating network "docker_default" with the default driver
Creating docker_cadvisor_1    ... done
Creating docker_prometheus_1 ... done
Creating docker_alertmanager_1 ... done
Creating docker_grafana_1    ... done

更多学习教程公众号风哥教程itpux_com