Logstash - docker部署
内存
注意Logstash的版本，需要与Elasticsearch, Kibana版本统一，这里是下载7.2.0版本的镜像
1.下载镜像
docker pull logstash:7.2.0
1
2.获取原始的配置信息
[root@iZuf61kbf845xt6tz10abgZ logstash]# docker run -d -p 5044:5044 --name logstash docker.io/logstash:7.2.0
9fba0cd4d460b6023975e0fd059d3e3e8b67f0745f516a694a48876d2263d051
[root@iZuf61kbf845xt6tz10abgZ logstash]# docker cp logstash:/usr/share/logstash/config ./tmp/
[root@iZuf61kbf845xt6tz10abgZ logstash]# docker cp logstash:/usr/share/logstash/pipeline ./tmp/
1
2
3
4
2
3
4
3.修改配置文件logstash.conf：
配置文件目录结构：
[root@iZuf61kbf845xt6tz10abgZ test]# tree
.
├── build_logstash.sh
├── config
│ ├── jvm.options
│ ├── logstash.conf
│ ├── logstash.yml
│ └── pipelines.yml
├── data
│ └── test.log
├── docker-compose.yml
└── pipeline
└── gitkeep
1
2
3
4
5
6
7
8
9
10
11
12
13
2
3
4
5
6
7
8
9
10
11
12
13
logstash.conf文件内容：
input {
file{
path => "/usr/share/logstash/data/test.log"
codec => json
start_position => "beginning"
}
}
output {
stdout {
codec => rubydebug
}
}
1
2
3
4
5
6
7
8
9
10
11
12
2
3
4
5
6
7
8
9
10
11
12
4.执行启动脚本build_logstash.sh
主要完成文件赋权和docker容器启动：
#/bin/bash
chmod 777 -R ./pipeline/
chmod 777 -R ./data/
chmod 777 -R ./config/
docker-compose up -d
1
2
3
4
5
6
7
2
3
4
5
6
7
5.启动容器，并向test.log输入信息
[root@iZuf61kbf845xt6tz10abgZ test]# cd /home/logstash/test/data/
[root@iZuf61kbf845xt6tz10abgZ data]# echo "hello world" >> test.log
[root@iZuf61kbf845xt6tz10abgZ data]# echo "logstash use test" >> test.log
1
2
3
2
3
6.另外启动一个窗口查看打印信息
docker logs -f --tail=200 stibel_logstash
/base_formatter.rb:31: warning: constant ::Fixnum is deprecated
{
"path" => "/usr/share/logstash/data/test.log",
"message" => "hello world",
"@version" => "1",
"@timestamp" => 2022-04-05T06:55:07.791Z,
"host" => "6dc97085cbff",
"tags" => [
[0] "_jsonparsefailure"
]
}
[DEBUG] 2022-04-05 06:55:53.946 [[main]<file] sincedbcollection - writing sincedb (delta since last write = 46)
{
"path" => "/usr/share/logstash/data/test.log",
"message" => "logstash use test",
"@version" => "1",
"@timestamp" => 2022-04-05T06:55:53.938Z,
"host" => "6dc97085cbff",
"tags" => [
[0] "_jsonparsefailure"
]
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25