docker 安装logstash

环境说明

操作系统：CentOS 7.7

docker版本：20.10.7

ip地址：192.168.38.129

logstash: 7.8.0

安装

1. 下载镜像

docker pull logstash:7.8.0

2. 配置

创建卷目录

mkdir -p /docker/elk/logstash/config/conf.d
mkdir -p /var/log/logstash
chmod -R 777 /docker/elk/logstash
chmod -R 777 /var/log/logstash
vi /docker/elk/logstash/config/logstash.yml

添加如下内容

http.host: "0.0.0.0"
path.config: /usr/share/logstash/conf.d/*.conf
path.logs: /var/log/logstash

vi /docker/elk/logstash/config/conf.d/logstash-spring.conf

配置如下(接收来自beat的数据，匹配多行，解析springboot默认日志格式)

input{
    beats{
        port => 5044
    }
}

filter{
        grok {
        	# 解析 eg: 2021-07-13 01:23:11.514 ERROR 15604 --- [main] o.s.boot.SpringApplication               : Application run failed
            match => [ "message", "(?m)^%{TIMESTAMP_ISO8601:logTime}%{SPACE}%{LOGLEVEL:logLevel}%{SPACE}%{NUMBER:pid}%{SPACE}---%{SPACE}%{SYSLOG5424SD:threadName}%{SPACE}%{NOTSPACE:loggerName}%{SPACE}:%{SPACE}%{GREEDYDATA:message}" ]
            # 覆盖原 message
            overwrite=> [ "message" ]
        }
}

output{
  elasticsearch {
        hosts => ["192.168.38.128:9200"]
        index => "spring-%{+YYYY.MM.dd}"
    }
  stdout { codec => rubydebug }
}

3. 启动logstash

docker run -d -it -p 5044:5044 \
  --name=logstash \
  --restart=always \
  -v /docker/elk/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml \
  -v /docker/elk/logstash/config/conf.d/:/usr/share/logstash/conf.d/ \
  -v /var/log/logstash:/var/log/logstash \
  logstash:7.8.0

4. 查看日志

docker logs -f logstash

5. 移除镜像

docker rm -f logstash