使用 Docker 部署 Elasticsearch & Kibana

Wed, 26 Aug 2026 00:00:00 +0000

如果您是第一次阅读该系列文章，建议优先阅读 Docker 部署项目说明及索引

ElasticSearch 是一款开源的分布式搜索与分析引擎，专为速度、可扩展性和 AI 应用而设计。

Kibana 是一款开源的数据可视化工具，用于查看和分析 Elasticsearch 中的数据。

注意：群晖 NAS 暂时无法部署 Elasticsearch 8.0 以上版本，请基于其他系统部署。

前置准备

.env

# Project namespace
COMPOSE_PROJECT_NAME=elastic-stack

# Elastic Stack Version
STACK_VERSION=9.5.2

# 密码
ELASTIC_PASSWORD=your_elastic_password
KIBANA_PASSWORD=your_kibana_password

配置文件

准备 elasticsearch.yml、kibana.yml 配置文件，并修改其中的参数。文件内容参考如下：

elasticsearch.yml

cluster.name: docker-cluster
node.name: es-node-1
node.roles: [ master, data, ingest ]
path.data: /usr/share/elasticsearch/data
path.logs: /usr/share/elasticsearch/logs
network.host: 0.0.0.0
http.port: 9200
transport.port: 9300
discovery.type: single-node
bootstrap.memory_lock: false
xpack.security.enabled: false
xpack.security.transport.ssl.enabled: false
xpack.security.http.ssl.enabled: false
http.cors.enabled: true
http.cors.allow-origin: "*"

kibana.yml

server.host: "0.0.0.0"
server.port: 5601
elasticsearch.hosts: ["http://es:9200"]
elasticsearch.username: kibana_system
elasticsearch.password: your_kibana_password
telemetry.enabled: false
telemetry.optIn: false
xpack.encryptedSavedObjects.encryptionKey: df8af2e337e15895b9f212de5e56702408de70325233874492a04405d5ae5f22
xpack.reporting.encryptionKey: 39539df1484f0e5e51521be72b64b86814a9bee4f49ecf7f5659117c49f28ed0
xpack.security.encryptionKey: 19b0330d867e2d0c7b584956ec3a97bdb839f2aa741334b390e38ff339b84fae

Docker Compose

name: ${COMPOSE_PROJECT_NAME}

services:
  es:
    image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
    container_name: es
    hostname: es
    restart: unless-stopped
    ports:
      - "9200:9200"
    volumes:
      - ./elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
      - ./elasticsearch/data:/usr/share/elasticsearch/data
      - ./elasticsearch/logs:/usr/share/elasticsearch/logs
    environment:
      - TZ=Asia/Shanghai
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - discovery.type=single-node
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s http://localhost:9200 | grep -q 'missing authentication credentials'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120
  es-init:
    image: curlimages/curl:latest
    container_name: es-init
    hostname: es-init
    restart: no
    command: >
      sh -c '
        if [ x${ELASTIC_PASSWORD} == x ]; then
          echo "ERROR: ELASTIC_PASSWORD is empty, check .env";
          exit 1;
        fi
        if [ x${KIBANA_PASSWORD} == x ]; then
          echo "ERROR: KIBANA_PASSWORD is empty, check .env";
          exit 1;
        fi;

        echo "Waiting for Elasticsearch availability";
        until curl -s http://es:9200 | grep -q "missing authentication credentials"; do sleep 10; done;
        echo "Setting kibana_system password";
        until curl -s -X POST http://es:9200/_security/user/kibana_system/_password -u "elastic:${ELASTIC_PASSWORD}" -H "Content-Type: application/json" -d "{\"password\":\"${KIBANA_PASSWORD}\"}" | grep -q "^{}"; do sleep 10; done;

        echo "All done!";
      '
    depends_on:
      es:
        condition: service_healthy
  kibana:
    image: docker.elastic.co/kibana/kibana:${STACK_VERSION}
    container_name: kibana
    hostname: kibana
    restart: unless-stopped
    ports:
      - "5601:5601"
    volumes:
      - ./kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml
      - ./kibana/data:/usr/share/kibana/data
    environment:
      - TZ=Asia/Shanghai
    depends_on:
      es:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120
networks:
  default:
    external: true
    name: rod

容器使用 elasticsearch 作为用户，uid:gid 为 1000:0。绑定本地目录时，注意权限设置。

测试

elasticsearch

访问 http://localhost:9200

用户名：elastic，密码：your_elastic_password。

返回类似如下内容：

{
    "name": "es-node-1",
    "cluster_name": "docker-cluster",
    "cluster_uuid": "v_NcfXkCQWOqjtiPLTY1bA",
    "version": {
        "number": "9.5.2",
        "build_flavor": "default",
        "build_type": "docker",
        "build_hash": "b42549c72e6e040825b13e5d8ebf7ff63886b24d",
        "build_date": "2026-08-18T10:07:58.745010960Z",
        "build_snapshot": false,
        "lucene_version": "10.5.1",
        "minimum_wire_compatibility_version": "8.19.0",
        "minimum_index_compatibility_version": "8.0.0"
    },
    "tagline": "You Know, for Search"
}

Kibana

访问 http://localhost:5601

用户名：elastic，密码：your_elastic_password。

注意：不要使用 kibana_system 登录。

常见问题

Elasticsearch: seccomp unavailable

在 Synology NAS 上启动时可能遇到如下报错：

{
  "@timestamp": "2026-08-26T05:56:35.252Z",
  "log.level": "ERROR",
  "message": "fatal exception while booting Elasticsearch",
  "ecs.version": "1.2.0",
  "service.name": "ES_ECS",
  "event.dataset": "elasticsearch.server",
  "process.thread.name": "main",
  "log.logger": "org.elasticsearch.bootstrap.Elasticsearch",
  "elasticsearch.node.name": "elasticsearch",
  "elasticsearch.cluster.name": "docker-cluster",
  "error.type": "java.lang.UnsupportedOperationException",
  "error.message": "seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed",
  "error.stack_trace": "java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\n\tat org.elasticsearch.nativeaccess@8.19.20/org.elasticsearch.nativeaccess.LinuxNativeAccess.tryInstallExecSandbox(LinuxNativeAccess.java:255)\n\tat org.elasticsearch.server@8.19.20/org.elasticsearch.bootstrap.Elasticsearch.initializeNatives(Elasticsearch.java:495)\n\tat org.elasticsearch.server@8.19.20/org.elasticsearch.bootstrap.Elasticsearch.initPhase2(Elasticsearch.java:188)\n\tat org.elasticsearch.server@8.19.20/org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:100)\n"
}

这是由于 DSM 内核未编译 seccomp 的原因，暂时无法解决。可尝试降低 Elasticsearch 版本 (8.0 以下) 并添加如下配置解决：

1
2

# 禁用系统调用过滤器
bootstrap.system_call_filter: false

Elasticsearch 8.0 版本以上该配置已失效不可使用。

Kibana: 无法检索检测引擎权限

Unable to create actions client because the Encrypted Saved Objects plugin is missing encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in the kibana.yml or use the bin/kibana-encryption-keys command. (500)

kibana.yml 配置文件中缺少加密密钥，在文件中添加以下配置：

1
2
3

xpack.encryptedSavedObjects.encryptionKey: df8af2e337e15895b9f212de5e56702408de70325233874492a04405d5ae5f22
xpack.reporting.encryptionKey: 39539df1484f0e5e51521be72b64b86814a9bee4f49ecf7f5659117c49f28ed0
xpack.security.encryptionKey: 19b0330d867e2d0c7b584956ec3a97bdb839f2aa741334b390e38ff339b84fae

上述密钥可通过 Kibana 指令快速生成：

`1`	`docker exec -it kibana bin/kibana-encryption-keys generate`

参考网址

附录：集群部署

.env

# Project namespace (defaults to the current folder name if not set)
COMPOSE_PROJECT_NAME=elastic-stack-cluster

# Version of Elastic products
STACK_VERSION=9.5.2

# Password for the 'elastic' user (at least 6 characters)
ELASTIC_PASSWORD=your_elastic_password

# Password for the 'kibana_system' user (at least 6 characters)
KIBANA_PASSWORD=your_kibana_password

# Set the cluster name
CLUSTER_NAME=docker-cluster

# Set to 'basic' or 'trial' to automatically start the 30-day trial
LICENSE=basic
#LICENSE=trial

# Port to expose Elasticsearch HTTP API to the host
ES_PORT=9200
#ES_PORT=127.0.0.1:9200

# Port to expose Kibana to the host
KIBANA_PORT=5601
#KIBANA_PORT=80

# Increase or decrease based on the available host memory (in bytes)
MEM_LIMIT=1073741824

# Kibana encryption keys
KIBANA_ENCRYPTED_SAVED_OBJECTS_ENCRYPTION_KEY=df8af2e337e15895b9f212de5e56702408de70325233874492a04405d5ae5f22
KIBANA_REPORTING_ENCRYPTION_KEY=39539df1484f0e5e51521be72b64b86814a9bee4f49ecf7f5659117c49f28ed0
KIBANA_SECURITY_ENCRYPTION_KEY=19b0330d867e2d0c7b584956ec3a97bdb839f2aa741334b390e38ff339b84fae

docker-compose.yml

name: ${COMPOSE_PROJECT_NAME}

services:
  elastic-stack-cluster-setup:
    image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
    container_name: elastic-stack-cluster-setup
    hostname: elastic-stack-cluster-setup
    restart: no
    volumes:
      - elastic-stack-certs:/usr/share/elasticsearch/config/certs
    user: "0"
    command: >
      bash -c '
        if [ x${ELASTIC_PASSWORD} == x ]; then
          echo "Set the ELASTIC_PASSWORD environment variable in the .env file";
          exit 1;
        elif [ x${KIBANA_PASSWORD} == x ]; then
          echo "Set the KIBANA_PASSWORD environment variable in the .env file";
          exit 1;
        fi;
        if [ ! -f config/certs/ca.zip ]; then
          echo "Creating CA";
          bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
          unzip config/certs/ca.zip -d config/certs;
        fi;
        if [ ! -f config/certs/certs.zip ]; then
          echo "Creating certs";
          echo -ne \
          "instances:\n"\
          "  - name: es01\n"\
          "    dns:\n"\
          "      - es01\n"\
          "      - localhost\n"\
          "    ip:\n"\
          "      - 127.0.0.1\n"\
          "  - name: es02\n"\
          "    dns:\n"\
          "      - es02\n"\
          "      - localhost\n"\
          "    ip:\n"\
          "      - 127.0.0.1\n"\
          "  - name: es03\n"\
          "    dns:\n"\
          "      - es03\n"\
          "      - localhost\n"\
          "    ip:\n"\
          "      - 127.0.0.1\n"\
          > config/certs/instances.yml;
          bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
          unzip config/certs/certs.zip -d config/certs;
        fi;
        echo "Setting file permissions"
        chown -R root:root config/certs;
        find . -type d -exec chmod 750 \{\} \;;
        find . -type f -exec chmod 640 \{\} \;;
        echo "Waiting for Elasticsearch availability";
        until curl -s --cacert config/certs/ca/ca.crt https://es01:9200 | grep -q "missing authentication credentials"; do sleep 30; done;
        echo "Setting kibana_system password";
        until curl -s -X POST --cacert config/certs/ca/ca.crt -u "elastic:${ELASTIC_PASSWORD}" -H "Content-Type: application/json" https://es01:9200/_security/user/kibana_system/_password -d "{\"password\":\"${KIBANA_PASSWORD}\"}" | grep -q "^{}"; do sleep 10; done;
        echo "All done!";
      '
    healthcheck:
      test: [ "CMD-SHELL", "[ -f config/certs/es01/es01.crt ]" ]
      interval: 1s
      timeout: 5s
      retries: 120

  es01:
    depends_on:
      elastic-stack-cluster-setup:
        condition: service_healthy
    image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
    container_name: es01
    hostname: es01
    restart: unless-stopped
    volumes:
      - elastic-stack-certs:/usr/share/elasticsearch/config/certs
      - elastic-stack-es01:/usr/share/elasticsearch/data
    ports:
      - ${ES_PORT}:9200
    environment:
      - node.name=es01
      - cluster.name=${CLUSTER_NAME}
      - cluster.initial_master_nodes=es01,es02,es03
      - discovery.seed_hosts=es02,es03
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - bootstrap.memory_lock=true
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=certs/es01/es01.key
      - xpack.security.http.ssl.certificate=certs/es01/es01.crt
      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.key=certs/es01/es01.key
      - xpack.security.transport.ssl.certificate=certs/es01/es01.crt
      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.license.self_generated.type=${LICENSE}
      - xpack.ml.use_auto_machine_memory_percent=true
    mem_limit: ${MEM_LIMIT}
    ulimits:
      memlock:
        soft: -1
        hard: -1
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120

  es02:
    depends_on:
      - es01
    image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
    container_name: es02
    hostname: es02
    restart: unless-stopped
    volumes:
      - elastic-stack-certs:/usr/share/elasticsearch/config/certs
      - elastic-stack-es02:/usr/share/elasticsearch/data
    environment:
      - node.name=es02
      - cluster.name=${CLUSTER_NAME}
      - cluster.initial_master_nodes=es01,es02,es03
      - discovery.seed_hosts=es01,es03
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - bootstrap.memory_lock=true
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=certs/es02/es02.key
      - xpack.security.http.ssl.certificate=certs/es02/es02.crt
      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.key=certs/es02/es02.key
      - xpack.security.transport.ssl.certificate=certs/es02/es02.crt
      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.license.self_generated.type=${LICENSE}
      - xpack.ml.use_auto_machine_memory_percent=true
    mem_limit: ${MEM_LIMIT}
    ulimits:
      memlock:
        soft: -1
        hard: -1
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120

  es03:
    depends_on:
      - es02
    image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
    container_name: es03
    hostname: es03
    restart: unless-stopped
    volumes:
      - elastic-stack-certs:/usr/share/elasticsearch/config/certs
      - elastic-stack-es03:/usr/share/elasticsearch/data
    environment:
      - node.name=es03
      - cluster.name=${CLUSTER_NAME}
      - cluster.initial_master_nodes=es01,es02,es03
      - discovery.seed_hosts=es01,es02
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - bootstrap.memory_lock=true
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=certs/es03/es03.key
      - xpack.security.http.ssl.certificate=certs/es03/es03.crt
      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.key=certs/es03/es03.key
      - xpack.security.transport.ssl.certificate=certs/es03/es03.crt
      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.license.self_generated.type=${LICENSE}
      - xpack.ml.use_auto_machine_memory_percent=true
    mem_limit: ${MEM_LIMIT}
    ulimits:
      memlock:
        soft: -1
        hard: -1
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120

  kibana:
    depends_on:
      es01:
        condition: service_healthy
      es02:
        condition: service_healthy
      es03:
        condition: service_healthy
    image: docker.elastic.co/kibana/kibana:${STACK_VERSION}
    container_name: kibana
    hostname: kibana
    restart: unless-stopped
    volumes:
      - elastic-stack-certs:/usr/share/kibana/config/certs
      - elastic-stack-kibana:/usr/share/kibana/data
    ports:
      - ${KIBANA_PORT}:5601
    environment:
      - SERVERNAME=kibana
      - ELASTICSEARCH_HOSTS=https://es01:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
      - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt
      - xpack.encryptedSavedObjects.encryptionKey=${KIBANA_ENCRYPTED_SAVED_OBJECTS_ENCRYPTION_KEY}
      - xpack.reporting.encryptionKey=${KIBANA_REPORTING_ENCRYPTION_KEY}
      - xpack.security.encryptionKey=${KIBANA_SECURITY_ENCRYPTION_KEY}
    mem_limit: ${MEM_LIMIT}
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120

volumes:
  elastic-stack-certs:
    driver: local
  elastic-stack-es01:
    driver: local
  elastic-stack-es02:
    driver: local
  elastic-stack-es03:
    driver: local
  elastic-stack-kibana:
    driver: local

networks:
  default:
    external: true
    name: rod

Elasticsearch on Tofuwine's Blog

使用 Docker 部署 Elasticsearch & Kibana

前置准备

.env

配置文件

elasticsearch.yml

kibana.yml

Docker Compose

测试

elasticsearch

Kibana

常见问题

Elasticsearch: seccomp unavailable

Kibana: 无法检索检测引擎权限

参考网址

附录：集群部署

.env

docker-compose.yml