ELK

version: '3.5'

services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.6.2
    container_name: elasticsearch
    environment:
      discovery.type: single-node
      ES_JAVA_OPTS: '-Xms1g -Xmx1g'
      ELASTIC_USERNAME: elastic
      ELASTIC_PASSWORD: changeme
      xpack.license.self_generated.type: basic
      xpack.security.enabled: true
      xpack.security.authc.api_key.enabled: true
    ports:
      - '9200:9200'
      - '9300:9300'
  kibana:
    image: docker.elastic.co/kibana/kibana:8.6.2
    container_name: kibana
    environment:
      ELASTICSEARCH_USERNAME: kibana_system
      ELASTICSEARCH_PASSWORD: changeme
      ES_JAVA_OPTS: '-Xms512m -Xmx512m'
    ports:
      - '5601:5601'
    depends_on:
      - elasticsearch

啟用帳號

curl -X POST -H "Content-Type: application/json" -d '{"password" : "changeme"}' http://elastic:changeme@localhost:9200/_security/user/kibana_system/_password 

Fleet-Server

docker run -it --rm -p 8220:8220 \
-e FLEET_SERVER_ELASTICSEARCH_HOST=http://192.168.86.22:9200 \
-e FLEET_SERVER_INSECURE_HTTP=true \
-e FLEET_SERVER_POLICY_ID=fleet-server-policy \
-e FLEET_SERVER_SERVICE_TOKEN=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE3MDMyMjE1MzMzMTE6dmRRdnVpOW1UX2FEZnhsUDBpU3R2UQ \
docker.elastic.co/beats/elastic-agent:8.10.2

ApmAgent

docker run -it --rm -p 8200:8200 \
-e FLEET_URL=https://localhost:8220 \
-e FLEET_INSECURE=true \
-e FLEET_ENROLL=1 \
-e FLEET_ENROLLMENT_TOKEN=... \
docker.elastic.co/beats/elastic-agent:8.10.2