Question

我在github中使用docker-elk并运行docker-elk container.my日志显示在kibana中。现在我想在docker-elk.for中使用文件节拍而不是logstash-forwarder，因为我在github中选择了弹性/节拍并构建了一个docker image.Now这包含在我的docker-compose.yml.now中当iam运行容器logstash运行时，弹性搜索运行但文件节拍退出代码为0。

这是我的docker-compose.yml

elasticsearch:
  image: elasticsearch:latest
  command: elasticsearch -Des.network.host=0.0.0.0
  ports:
    - "9200:9200"
logstash:
  image: logstash:2.0
  command: logstash agent --config /etc/logstash/conf.d/ -l /var/log/logstash/logstash.log --debug
  volumes:
    - ./logstash/config:/etc/logstash/conf.d
    - ./logstash/patterns/nginx:/etc/logstash/patterns/nginx

  ports:
    - "5000:5000"
  links:
    - elasticsearch
kibana:
  build: kibana/
  volumes:
    - ./kibana/config/kibana.yml:/opt/kibana/config/kibana.yml
  ports:
    - "5601:5601"
  links:
    - elasticsearch
beats:
  image: pavankuamr/beats

  volumes:
   - ./logstash/beats:/etc/filebeat
   - /var/log/nginx:/var/log/nginx
  links:
   - logstash
   - elasticsearch
  environment:
   - ES_HOST=elasticsearch
   - LS_HOST=logstash
   - LS_TCP_PORT=5044

这是我的filebeat.yml

filebeat:

  prospectors:

      paths:
        - /var/log/nginx/access.log



      input_type: log


   registry_file: /var/lib/filebeat/registry


   config_dir: /etc/filebeat/conf.d



  elasticsearch:
    enabled: false

    hosts: ["localhost:9200"]




   logstash:
    # The Logstash hosts
    enabled: true
    hosts: ["localhost:5044"]

这是我的logstash.conf

input {
  beats {
   port => 5044
   type => "logs"
  }
  file {
    type => "nginx"
    start_position => "beginning"
    path => [ "/var/log/nginx/access.log" ]
  }
 file {
    type => "nginxerror"
    start_position => "beginning"
    path => [ "/var/log/nginx/error.log" ]
  }
}
filter {

  if [type] == "nginx" {
    grok {
    patterns_dir => "/etc/logstash/patterns"
    match => { "message" => "%{NGINX_ACCESS}" }
    remove_tag => ["_grokparsefailure"]
    add_tag => ["nginx_access"]
    }

    geoip {
      source => "remote_addr"
    }
  }

  if [type] == "nginxerror" {
    grok {
    patterns_dir => "/etc/logstash/patterns"
    match => { "message" => "%{NGINX_ERROR}" }
    remove_tag => ["_grokparsefailure"]
    add_tag => ["nginx_error"]
    }

  }
}


output {
    elasticsearch {

        hosts => "elasticsearch:9200"
                sniffing => true
                manage_template => false
                index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
                document_type => "%{[@metadata][type]}"
    }

}

Answer 1

将hosts: ["localhost:9200"]的{{1}}更改为hosts: ["logstash:9200"]上的logstash输出

为什么docker filebeat退出代码0？

1 个答案: