实战：使用Docker Compose运行ELK

  • ElasticSearch【存储】
  • Logtash【日志聚合器】
  • Kibana【界面】

答案：

  1. version: '2'
  2. services:
  3.  elasticsearch:
  4.   image: elasticsearch
  5.   # command: elasticsearch
  6.   ports:
  7.    - "9200:9200"   # REST API端口
  8.    - "9300:9300"   # RPC端口
  9.  logstash:
  10.   image: logstash
  11.   command: logstash -f /etc/logstash/conf.d/logstash.conf
  12.   volumes:
  13.    - ./config:/etc/logstash/conf.d
  14.    - /opt/build:/opt/build
  15.   ports:
  16.    - "5000:5000"
  17.  kibana:
  18.   image: kibana
  19.   environment:
  20.    - ELASTICSEARCH_URL=http://elasticsearch:9200
  21.   ports:
  22.    - "5601:5601"

logstash.conf 参考示例：

  1. input {
  2.   file {
  3.     codec => json
  4.     path => "/opt/build/*.json"
  5.   }
  6. }
  7. filter {
  8.   grok {
  9.     match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span},%{DATA:exportable}\]\s+%{DATA:pid}---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:rest}" }
  10.   }
  11. }
  12. output {
  13.   elasticsearch {
  14.     hosts => "elasticsearch:9200"
  15.   }
  16. }

参考文档

https://docs.docker.com/compose/samples-for-compose/#samples-tailored-to-demo-compose