Question

所以我使用docker-compose来启动ELK堆栈，这将由filebeats填充...我的配置是这样的：

elasticsearch:
  image: elasticsearch:latest
  command: elasticsearch -Des.network.host=_non_loopback_
  ports:
    - "9200:9200"
    - "9300:9300"
logstash:
  image: logstash:latest
  command: logstash -f /etc/logstash/conf.d/logstash.conf -b 10000 -w 1
  volumes:
    - ./logstash/config:/etc/logstash/conf.d
  ports:
    - "5044:5044"
  links:
    - elasticsearch
  environment:
    - LS_HEAP_SIZE=2048m
kibana:
  build: kibana/
  volumes:
    - ./kibana/config/:/opt/kibana/config/
  ports:
    - "5601:5601"
  links:
    - elasticsearch

我的logstash.conf文件如下所示：

input {
    beats {
      port => 5044
    }
}

....

output {
  elasticsearch {
      hosts => "localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
      document_type => "%{[@metadata][type]}"
    }
  }

这些docker容器在同一个实例上运行，我已经确认能够在外部命中两个端口。

从filebeat同步文件时出现的错误是：

logstash_1       | {:timestamp=>"2016-05-19T19:52:55.167000+0000", :message=>"Attempted to send a bulk request to Elasticsearch configured at '[\"http://localhost:9200/\"]', but Elasticsearch appears to be unreachable or down!", :error_message=>"Connection refused", :class=>"Manticore::SocketException", :client_config=>{:hosts=>["http://localhost:9200/"], :ssl=>nil, :transport_options=>{:socket_timeout=>0, :request_timeout=>0, :proxy=>nil, :ssl=>{}}, :transport_class=>Elasticsearch::Transport::Transport::HTTP::Manticore, :logger=>nil, :tracer=>nil, :reload_connections=>false, :retry_on_failure=>false, :reload_on_failure=>false, :randomize_hosts=>false, :http=>{:scheme=>"http", :user=>nil, :password=>nil, :port=>9200}}, :level=>:error}

谢谢，

Answer 1

您尝试在localhost上访问elasticsearch，但它不可能，在这种情况下，localhost是包含logstash的docker容器。

您必须通过链接访问它：

output {
 elasticsearch {
  hosts => "elasticsearch:9200"
  manage_template => false
  index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
  document_type => "%{[@metadata][type]}"
 }
}

或者，如果您想从＆＃34;外部＆＃34;访问您的弹性搜索实例而不是localhost，填写你的IP（不是127.0.0.1）

Docker - ELK堆栈 - “Elasticsearch似乎无法访问或关闭”

1 个答案: