1、搜索镜像库filebeat
docker search filebeat
2、拉取镜像
docker pull prima/filebeat
3、创建配置文件
mkdir -p /etc/filebeat
cd /etc/filebeat
touch filebeat.yml
设置权限
chmod go-w filebeat.yml
4、设置filebeat配置文件
filebeat.prospectors:
- type: log
enabled: true
harvester_buffer_size: 409600
ignore_older: 168h
paths:
- /lms_log/lms-info*.log
fields:
log_source: test
app: lms
fields_under_root: true
multiline.pattern: ^(\d{4}|\d{2})\-(\d{2}|[a-zA-Z]{3})\-(\d{2}|\d{4})
multiline.negate: true
multiline.match: after
- type: log
enabled: true
harvester_buffer_size: 409600
ignore_older: 168h
paths:
- /cps_log/cps-info*.log
fields:
log_source: test
app: cps
fields_under_root: true
multiline.pattern: ^(\d{4}|\d{2})\-(\d{2}|[a-zA-Z]{3})\-(\d{2}|\d{4})
multiline.negate: true
multiline.match: after
filebeat.config:
modules:
path: /etc/filebeat/*.yml
reload.enabled: false
filebeat.registry_file: /var/lib/filebeat/registry
output.redis:
hosts: ["192.168.0.70:6379"]
password: "pwd666"
key: "elklog"
db: 1
timeout: 60
max_procs: 1
queue:
mem:
events: 10240
flush.min_events: 5120
flush.timeout: 10s
5、创建容器
docker run --network=host --restart=always --log-driver json-file --name filebeat --user=root -d
-v /opt/epean/trade/logs/:/lms_log/ #用于映射日志
-v /mnt/epean/trade/logs/:/cps_log/ #用于映射日志
-v /var/lib/filebeat/:/var/lib/filebeat/ #用于映射registry
-v /etc/filebeat/filebeat.yml:/filebeat.yml #用于映射配置文件
prima/filebeat -e -strict.perms=false
6、可能遇到的问题
1、如果遇到registry找不到 或者 /data/registry 无文件等错误
多半是没有配置filebeat.registry_file: /var/lib/filebeat/registry
2、如果遇到**registry是一个目录,而不是一个文件等错误
可以删除registry文件夹,然后重启filebeat
rm -rf /var/lib/filebeat/registry