docker安装filebeat并推送到redis

1、搜索镜像库filebeat

docker search filebeat

2、拉取镜像

docker pull prima/filebeat

3、创建配置文件

mkdir -p /etc/filebeat
cd /etc/filebeat
touch filebeat.yml

设置权限
chmod go-w filebeat.yml

4、设置filebeat配置文件

filebeat.prospectors:
- type: log
  enabled: true
  harvester_buffer_size: 409600
  ignore_older: 168h
  paths:
    - /lms_log/lms-info*.log
  fields:
    log_source: test
    app: lms
  fields_under_root: true
  multiline.pattern: ^(\d{4}|\d{2})\-(\d{2}|[a-zA-Z]{3})\-(\d{2}|\d{4})
  multiline.negate: true
  multiline.match: after
- type: log
  enabled: true
  harvester_buffer_size: 409600
  ignore_older: 168h
  paths:
    - /cps_log/cps-info*.log
  fields:
    log_source: test
    app: cps
  fields_under_root: true
  multiline.pattern: ^(\d{4}|\d{2})\-(\d{2}|[a-zA-Z]{3})\-(\d{2}|\d{4})
  multiline.negate: true
  multiline.match: after
filebeat.config:
  modules:
    path: /etc/filebeat/*.yml
    reload.enabled: false
filebeat.registry_file: /var/lib/filebeat/registry
output.redis:
  hosts: ["192.168.0.70:6379"]
  password: "pwd666"
  key: "elklog"
  db: 1
  timeout: 60
max_procs: 1
queue:
  mem:
    events: 10240
    flush.min_events: 5120
    flush.timeout: 10s

5、创建容器

docker run --network=host --restart=always --log-driver json-file --name filebeat --user=root -d
-v /opt/epean/trade/logs/:/lms_log/  #用于映射日志
-v /mnt/epean/trade/logs/:/cps_log/  #用于映射日志
-v /var/lib/filebeat/:/var/lib/filebeat/  #用于映射registry
-v /etc/filebeat/filebeat.yml:/filebeat.yml  #用于映射配置文件
prima/filebeat -e -strict.perms=false

6、可能遇到的问题

1、如果遇到registry找不到 或者 /data/registry 无文件等错误
多半是没有配置filebeat.registry_file: /var/lib/filebeat/registry
2、如果遇到**registry是一个目录，而不是一个文件等错误
可以删除registry文件夹，然后重启filebeat
rm -rf /var/lib/filebeat/registry