1:安装docker logstash
docker pull logstash:7.9.3
2:运行docker
docker run -d --restart=always --log-driver json-file --log-opt max-size=100m --log-opt max-file=2 -p 5044:5044 --name logstash2.0 logstash:7.9.3
3: 修改配置文件
进入docker docker exec -it --user root 963775d89ddc /bin/bash
vim config/logstash-sample.conf
1:vim config/logstash-sample.conf
vim pipeline/logstash.conf
input {
beats {
port => 5044
}
}
output {
stdout { codec=>rubydebug}
}
2:vim config/logstash.yml
http.host: "0.0.0.0"
#xpack.monitoring.elasticsearch.hosts: [ "http://elasticsearch:9200" ]
4: 重启docker
5:查看日志 docker logs --tail 100 --follow 963775d89ddc
安装filebeat,检测是否安装成功
1:在官网https://www.elastic.co/cn/downloads/beats/filebeat查看安装方法安装
2:修改配置(里面有output.logstash先注释掉)
vim /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
paths:
- /home/l/filebeat/logstash-tutorial.log # 须填写绝对路径
output.logstash:
hosts: ["localhost:5044"]
3:启动filebeat -e -c filebeat.yml -d "publish"
4:echo "================" >> /home/l/filebeat/logstash-tutorial.log
5:在logstash日志里看到有上报