1.使用docker compose一键安装es,logstash,kibana

services:
  elasticsearch:
    image: elasticsearch:8.12.0
    environment:
      - discovery.type=single-node
      - ES_JAVA_OPTS=-Xms512m -Xmx512m
      - xpack.security.enabled=true
      - ELASTIC_PASSWORD=password
      - xpack.license.self_generated.type=basic
    networks:
      - elastic
    ports:
      - "9200:9200"
    volumes:
      - es-data:/usr/share/elasticsearch/data

  kibana:
    image: kibana:8.12.0
    ports:
      - "5601:5601"
    networks:
      - elastic
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=password
    depends_on:
      - elasticsearch
      
  logstash:
    image: docker.elastic.co/logstash/logstash:9.2.4
    container_name: logstash
    ports:
      - "5044:5044"
      - "5000:5000"
      - "9600:9600"  # Logstash监控端口
    environment:
      - LS_JAVA_OPTS=-Xmx512m -Xms512m
      - XPACK_MONITORING_ENABLED=false
    volumes:
      - ./pipeline:/usr/share/logstash/pipeline
      - ./config/logstash.yml:/usr/share/logstash/config/logstash.yml
      - ./data:/usr/share/logstash/data
    networks:
      - elastic
    restart: unless-stopped
    depends_on:
      - elasticsearch

# 必须定义 volumes
volumes:
  es-data:
    driver: local
networks:
  elastic:
    driver: bridge

logstash.yaml

input {
  tcp {
    port => 5000  # 与 Java 配置一致
    codec => json_lines
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]  # 转发到 ES
     # 使用环境变量
    user => "elastic"
    password => "password"
    index => "java-app-%{+YYYY.MM.dd}"
  }
}

需要根据docker-compose.yaml的挂载目录挂载相应文件。