# ELK docker 建置
- Elasticsearch + Logstash + Kibana 建置教學
- ENV -> macOS + docker

筆記 :+1:
官網提到當系統發生 swag 時，ES的效能會變得非常之差，最可怕的情況是會脫離節點，因此設定 memory lock 來避免此案發生。
> Swapping is very bad for performance and for node stability and should be avoided at all costs. It can cause garbage collections to last for minutes instead of milliseconds and can cause nodes to respond slowly or even to disconnect from the cluster.

version: '2'

services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.2.4
    ulimits:
      memlock: -1
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      ES_JAVA_OPTS: "-Xms1g -Xmx1g"
      bootstrap.memory_lock: "true"
    networks:
      - elk

  logstash:
    image: docker.elastic.co/logstash/logstash:6.2.4
    ports:
      - "5000:5000"
    networks:
      - elk
    depends_on:
      - elasticsearch

  kibana:
    image: docker.elastic.co/kibana/kibana:6.2.4
    ports:
      - "5601:5601"
    networks:
      - elk
    depends_on:
      - elasticsearch

networks:
  elk:
    driver: bridge

## ISSUE - Elasticsearch 崩潰

建置 ELK 三兄弟後，啟動 Mariadb 或者其他容器後 Elasticsearch 容器崩潰。
主要原因是因為，MAC 的 docker memory 不足，只要調整 docker memory 上限後即可。需注意的是 Elasticsearch 在沒有倒入任何資料情況下就佔用 1.4G Memory 了。建議把 docker 的 Memory 開到 4~6G 比較保險