• 在Linux环境中使用Elasticsearch还需要修改一些系统限制。修改步骤如下：

# 修改/etc/sysctl.conf文件
# max_map_count文件包含限制一个进程可以拥有的VMA(虚拟内存区域)的数量。虚拟内存区域是一个连续的虚拟地址空间区域。在进程的生命周期中，每当程序尝试在内存中映射文件，链接到共享内存段，或者分配堆空间的时候，这些区域将被创建。调优这个值将限制进程可拥有VMA的数量。限制一个进程拥有VMA的总数可能导致应用程序出错，因为当进程达到了VMA上线但又只能释放少量的内存给其他的内核进程使用时，操作系统会抛出内存不足的错误。如果你的操作系统在NORMAL区域仅占用少量的内存，那么调低这个值可以帮助释放内存给内核用。
vm.max_map_count=262144
# fs.file-max决定了系统级别所有进程可以打开的文件描述符的数量限制，如果内核中遇到VFS: file-max limit <number> reached的信息，那么就提高这个值。
fs.file-max = 6815744

• 下面开始写配置文件在yourpath目录下创建.env、docker-compose.yml、es01.yml三个文件

  • .env:

    # Password for the 'elastic' user (at least 6 characters)
    ELASTIC_PASSWORD=elastic
    
    # Password for the 'kibana_system' user (at least 6 characters)
    KIBANA_PASSWORD=kibana_system
    
    # Version of Elastic products
    STACK_VERSION=8.4.3
    
    # Set the cluster name
    CLUSTER_NAME=docker-cluster
    
    # Set to 'basic' or 'trial' to automatically start the 30-day trial
    LICENSE=basic
    #LICENSE=trial
    
    # Port to expose Elasticsearch HTTP API to the host
    ES_PORT=9222
    #ES_PORT=127.0.0.1:9200
    ES_TCP_PORT=9333
    # Port to expose Kibana to the host
    KIBANA_PORT=5622
    #KIBANA_PORT=80
    
    # Increase or decrease based on the available host memory (in bytes)
    MEM_LIMIT=1073741824
    
    # Project namespace (defaults to the current folder name if not set)
    #COMPOSE_PROJECT_NAME=myproject

  • docker-compose.yml：

  version: "2.2"
  
  services:
    setup:
      container_name: es_setup
      image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
      volumes:
        - /yourpath/certs:/usr/share/elasticsearch/config/certs
      user: "0"
      command: >
        bash -c '
          if [ x${ELASTIC_PASSWORD} == x ]; then
            echo "Set the ELASTIC_PASSWORD environment variable in the .env file";
            exit 1;
          elif [ x${KIBANA_PASSWORD} == x ]; then
            echo "Set the KIBANA_PASSWORD environment variable in the .env file";
            exit 1;
          fi;
          if [ ! -f config/certs/ca.zip ]; then
            echo "Creating CA";
            bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
            unzip config/certs/ca.zip -d config/certs;
          fi;
          if [ ! -f config/certs/certs.zip ]; then
            echo "Creating certs";
            echo -ne \
            "instances:\n"\
            "  - name: es01\n"\
            "    dns:\n"\
            "      - es01\n"\
            "      - localhost\n"\
            "    ip:\n"\
            "      - 127.0.0.1\n"\
            > config/certs/instances.yml;
            bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
            unzip config/certs/certs.zip -d config/certs;
          fi;
          echo "Setting file permissions"
          chown -R root:root config/certs;
          find . -type d -exec chmod 750 \{\} \;;
          find . -type f -exec chmod 640 \{\} \;;
          echo "All done!";
        '
      networks:
        - elastic
      healthcheck:
        test: ["CMD-SHELL", "[ -f config/certs/es01/es01.crt ]"]
        interval: 1s
        timeout: 5s
        retries: 120
  
    es01:
      container_name: es01
      depends_on:
        setup:
          condition: service_healthy
      image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
      volumes:
        - /yourpath/certs:/usr/share/elasticsearch/config/certs
        - /yourpath/esdata01:/usr/share/elasticsearch/data
        - /yourpath/logs:/usr/share/elasticsearch/logs
        - /yourpath/plugins:/usr/share/elasticsearch/plugins
        - /yourpath/es01.yml:/usr/share/elasticsearch/config/elasticsearch.yml
      ports:
        - ${ES_PORT}:9200
        - ${ES_TCP_PORT}:9300
      mem_limit: ${MEM_LIMIT}
      ulimits:
        memlock:
          soft: -1
          hard: -1
      networks:
        - elastic
      healthcheck:
        test:
          [
            "CMD-SHELL",
            "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
          ]
        interval: 10s
        timeout: 10s
        retries: 120
  
    kibana:
      container_name: kibana
      depends_on:
        es01:
          condition: service_healthy
      image: docker.elastic.co/kibana/kibana:${STACK_VERSION}
      volumes:
        - /yourpath/certs:/usr/share/kibana/config/certs
        - /yourpath/kibanadata:/usr/share/kibana/data
      ports:
        - ${KIBANA_PORT}:5601
      environment:
        - SERVERNAME=kibana
        - ELASTICSEARCH_URL=https://es01:9200
        - ELASTICSEARCH_HOSTS=https://es01:9200
        - ELASTICSEARCH_USERNAME=kibana_system
        - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
        - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt
      mem_limit: ${MEM_LIMIT}
      networks:
        - elastic
      healthcheck:
        test:
          [
            "CMD-SHELL",
            "curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'",
          ]
        interval: 10s
        timeout: 10s
        retries: 120
  networks:
    elastic:
      driver: bridge

  • es01.yml：

  # 配置Elasticsearch的集群名称，默认是Elasticsearch，建议修改成一个有意义的名称
  cluster.name: es-docker-cluster
  # Elasticsearch节点名称，Elasticsearch默认会随机指定一个名字，建议指定一个有意义的名称，方便管理
  node.name: es01
  #discovery.seed_hosts: es02,es03
  cluster.initial_master_nodes: es01 #,es02,es0
  # 允许外部网络访问
  network.host: 0.0.0.0
  #支持跨域
  http.cors.enabled: true
  #支持所有域名
  http.cors.allow-origin: "*"
  http.cors.allow-headers: Authorization
  ES_JAVA_OPTS: "-Xms512m -Xmx512m"
  # 开启xpack安全校验，在kibana中使用就需要输入账号密码
  bootstrap.memory_lock: true
  xpack.security.enabled: true
  xpack.security.http.ssl.enabled: true
  xpack.security.http.ssl.key: certs/es01/es01.key
  xpack.security.http.ssl.certificate: certs/es01/es01.crt
  xpack.security.http.ssl.certificate_authorities: certs/ca/ca.crt
  xpack.security.http.ssl.verification_mode: certificate
  xpack.security.transport.ssl.enabled: true
  xpack.security.transport.ssl.key: certs/es01/es01.key
  xpack.security.transport.ssl.certificate: certs/es01/es01.crt
  xpack.security.transport.ssl.certificate_authorities: certs/ca/ca.crt
  xpack.security.transport.ssl.verification_mode: certificate
  xpack.license.self_generated.type: basic

• 执行docker-compose up -d，然后执行docker exec -it elastic /bin/bash进入容器内部，执行elasticsearch-setup-passwords interactive设置密码：

  # elasticsearch-setup-passwords interactive
  Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
  You will be prompted to enter passwords as the process progresses.
  Please confirm that you would like to continue [y/N]y
  
  
  Enter password for [elastic]: 
  Reenter password for [elastic]: 
  Enter password for [apm_system]: 
  Reenter password for [apm_system]: 
  Enter password for [kibana_system]: 
  Reenter password for [kibana_system]: 
  Enter password for [logstash_system]: 
  Reenter password for [logstash_system]: 
  Enter password for [beats_system]: 
  Reenter password for [beats_system]: 
  Enter password for [remote_monitoring_user]: 
  Reenter password for [remote_monitoring_user]: 
  Passwords do not match.
  Try again.
  Enter password for [remote_monitoring_user]: 
  Reenter password for [remote_monitoring_user]: 
  Changed password for user [apm_system]
  Changed password for user [kibana_system]
  Changed password for user [kibana]
  Changed password for user [logstash_system]
  Changed password for user [beats_system]
  Changed password for user [remote_monitoring_user]
  Changed password for user [elastic]

  重置密码后，将kibana.yml、.env的kibana_system密码修改为充值后的密码，然后执行docker-compose up -d。

文中代码已上传github。