logstash 挂载方式启动

docker run -it --name logstash \
--privileged=true \
--restart=always \
-p 5044:5044 \
-p 9600:9600 \
-e ES_JAVA_OPTS="-Duser.timezone=Asia/Shanghai" \
-v /gdc/app/logstash/logstash/config:/usr/share/logstash/config \
-v /gdc/app/logstash/logstash/data:/usr/share/logstash/data \
-v /gdc/app/logstash/logstash/logs:/usr/share/logstash/logs \
-v /gdc/app/logstash/logstash/pipeline:/usr/share/logstash/pipeline \
-d elastic/logstash:7.10.2

##docker 目录映射
docker cp logstash:/usr/share/logstash/config /home/xxx/elk8.4.3/logstash/ 
##获取容器离线日志具体位置
docker inspect --format='{{.LogPath}}' logstash



##增量传输是提示文件没有权限

先rm掉实例，然后重新run时加上  --privileged=true