节点监控+日志分析：R9-9950X 32核同时运行多个监控服务不卡顿

# 安装Docker和Docker Compose
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
sudo curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

# 创建docker-compose.yml
cat > docker-compose.yml << 'EOF'
version: '3.8'
services:
  prometheus:
    image: prom/prometheus:latest
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --web.enable-lifecycle
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus_data:/prometheus
    ports:
      - "9090:9090"

  thanos-sidecar:
    image: quay.io/thanos/thanos:latest
    command:
      - sidecar
      - --prometheus.url=http://prometheus:9090
      - --tsdb.path=/prometheus
      - --objstore.config-file=/etc/thanos/objstore.yml
    volumes:
      - ./thanos/objstore.yml:/etc/thanos/objstore.yml
      - prometheus_data:/prometheus
    depends_on:
      - prometheus

  thanos-store:
    image: quay.io/thanos/thanos:latest
    command:
      - store
      - --data-dir=/data
      - --objstore.config-file=/etc/thanos/objstore.yml
    volumes:
      - ./thanos/objstore.yml:/etc/thanos/objstore.yml
      - thanos_store:/data

  thanos-query:
    image: quay.io/thanos/thanos:latest
    command:
      - query
      - --http-address=0.0.0.0:9090
      - --store=thanos-sidecar:10901
      - --store=thanos-store:10901
    ports:
      - "9091:9090"
    depends_on:
      - thanos-sidecar
      - thanos-store

  thanos-compactor:
    image: quay.io/thanos/thanos:latest
    command:
      - compact
      - --data-dir=/data
      - --objstore.config-file=/etc/thanos/objstore.yml
      - --wait
    volumes:
      - ./thanos/objstore.yml:/etc/thanos/objstore.yml
      - thanos_compact:/data

volumes:
  prometheus_data:
  thanos_store:
  thanos_compact:
EOF

# 启动所有服务
docker-compose up -d

# 创建docker-compose.elk.yml
cat > docker-compose.elk.yml << 'EOF'
version: '3.8'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
    environment:
      - node.name=elasticsearch
      - cluster.name=elk-cluster
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms31g -Xmx31g"  # 利用128G内存
      - xpack.security.enabled=false
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - es_data:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"
      - "9300:9300"

  logstash:
    image: docker.elastic.co/logstash/logstash:8.11.0
    volumes:
      - ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf
      - ./logstash.yml:/usr/share/logstash/config/logstash.yml
    ports:
      - "5000:5000/tcp"
      - "5000:5000/udp"
      - "9600:9600"
    environment:
      - LS_JAVA_OPTS=-Xms4g -Xmx4g
    depends_on:
      - elasticsearch

  kibana:
    image: docker.elastic.co/kibana/kibana:8.11.0
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    depends_on:
      - elasticsearch

volumes:
  es_data:
EOF

# 创建logstash配置
cat > logstash.conf << 'EOF'
input {
  beats {
    port => 5044
  }
  tcp {
    port => 5000
  }
}

filter {
  grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
  }
  date {
    match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
  }
}

output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
    index => "logs-%{+YYYY.MM.dd}"
  }
}
EOF

# 启动ELK
docker-compose -f docker-compose.elk.yml up -d

# 安装Filebeat
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.11.0-amd64.deb
sudo dpkg -i filebeat-8.11.0-amd64.deb

# 配置Filebeat
cat > /etc/filebeat/filebeat.yml << 'EOF'
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.log
    - /var/log/nginx/*.log

output.logstash:
  hosts: ["localhost:5044"]

logging.level: info
EOF

# 启动Filebeat
sudo systemctl enable filebeat
sudo systemctl start filebeat

# 开放必要端口
ufw allow 9090/tcp  # Prometheus
ufw allow 9091/tcp  # Thanos Query
ufw allow 9200/tcp  # Elasticsearch
ufw allow 5601/tcp  # Kibana
ufw allow 5000/tcp  # Logstash TCP
ufw allow 5044/tcp  # Filebeat