步骤一 搭建swarm集群环境

1、创建keystore宿主机，创建命令如下：

eval "$(docker-machine env elk-keystore)"

2、在elk-keystore宿主机上创建consul容器，创建命令如下：

1）eval "$(docker-machine env elk-keystore)"

 2）docker run -d \
    -p "8500:8500" \
    -h "consul" \
    progrium/consul -server -bootstrap

3）创建elasticsearch宿主机（同时作为swarm集群的master节点），创建命令如下：

docker-machine create \
-d virtualbox \
--swarm --swarm-master \
--swarm-discovery="consul://$(docker-machine ip mh-keystore):8500" \
--engine-opt="cluster-store=consul://$(docker-machine ip mh-keystore):8500" \
--engine-opt="cluster-advertise=eth1:2376" \
mh-elasticsearch

4）创建logstash宿主机，创建命令如下：

docker-machine create -d virtualbox \
    --swarm \
    --swarm-discovery="consul://$(docker-machine ip mh-keystore):8500" \
    --engine-opt="cluster-store=consul://$(docker-machine ip mh-keystore):8500" \
    --engine-opt="cluster-advertise=eth1:2376" \
  mh-logstash

5）创建kibana宿主机，创建命令如下：

docker-machine create -d virtualbox \
    --swarm \
    --swarm-discovery="consul://$(docker-machine ip mh-keystore):8500" \
    --engine-opt="cluster-store=consul://$(docker-machine ip mh-keystore):8500" \
    --engine-opt="cluster-advertise=eth1:2376" \
  mh-kibana

步骤二 检验集群环境是否搭建成功，利用命令docker info监测

步骤三  利用docker-compose搭建创建ELK容器，yml文件如下所示：

version: '2'
services:
     elasticsearch:
              image: elasticsearch:latest
              volumes:
                  - /c/Users/xu/Desktop/elkcompose/elasticsearch/data/:/usr/share/elasticsearch/data
              environment:
                  - "constraint:node==mh-elasticsearch"
                  #- ES_CLUSTERNAME=elasticsearch
              command: elasticsearch -Des.config=/usr/share/elasticsearch/config/elasticsearch.yml
              ports:
                  - "9200:9200"
                  - "9300:9300"
              networks:
                  - mynet           
     kibana:
              image: kibana:latest
              ports:
                  - "5601:5601"
              depends_on:
                  - elasticsearch     
              networks:
                  - mynet
              links:
                  - elasticsearch:elasticsearch
              environment:
                  - "constraint:node==mh-kibana"
     logstash:
              image: logstash:latest
              ports:
                  - "25826:25826"
                  - "25826:25826/udp"
              networks:
                  - mynet
              links:
                  - elasticsearch:elasticsearch
              depends_on:
                  - elasticsearch
              volumes:
                  - /c/Users/xu/Desktop/elkcompose/logstash/conf/:/conf
                  - /c/Users/xu/Desktop/elkcompose/logstash/testdata/:/testdata
              command: logstash agent -f /conf/logstash.conf
              environment:
                  - "constraint:node==mh-logstash"
networks:
    mynet:

启动docker-compose，命令如下：

1）eval $(docker-machine env --swarm mh-elasticsearch)

2) docker-compose up