Logstash安装

• 拉取镜像

docker pull docker.elastic.co/logstash/logstash:7.9.3 

• pipeline管道配置文件创建

logstash.conf

#aracter at the beginning of a line indicates a comment. Use
# comments to describe your configuration.
input {
##此处如果是ELK配置，可以配置kafka数据源，若是filebeat,也可以配置beat数据源
  kafka {   
        bootstrap_servers => "192.168.47.131:9092"  ##Kafka的配置
        consumer_threads => 5
        topics_pattern => "topic_log_.*"
        decorate_events => true
        codec =>"json"
        auto_offset_reset => "earliest"
        group_id => "logstash1"
   }

}
# The filter part of this file is commented out to indicate that it is
# optional.
filter {     ##
     #  json{
    #    source =>"message"
   #     target =>"doc"
  #  }
 }
output {
  elasticsearch {   ##如果有x-pack安全模块，还需要加上x-pack安全模块的配置
    action => "index"
    hosts => ["192.168.47.128:9200","192.168.47.129:9201"]
    index => "%{[appname]}"
    }

  stdout{
   codec =>rubydebug
}
}

• 启动脚本

 docker run -d --name logstash \
 -p 5045:5045  \
 -v /root/logstash/config/logstash.conf:/usr/share/logstash/pipeline/logstash.conf  \ 挂载配置文件
 docker.elastic.co/logstash/logstash:7.9.3

官方文档：https://www.elastic.co/guide/en/logstash/7.x/index.html