[root@linux-node5 ~]# sysctl vm.max_map_count=262144 修改系统参数
[root@linux-node5 ~]# docker run -p 5601:5601 -p 9200:9200 -p 5044:5044 -it --rm --name elk sebp/elk 起额elk镜像
打开网页,测试下
安装一个filebeat (我已经有了)
[root@linux-node3 ~]# vim /etc/filebeat/filebeat.yml
enabled: true
- /var/lib/docker/containers/./*.log -增加
#output.elasticsearch:Array of hosts to connect to.
hosts: [“10.0.0.19:9200”]
[root@linux-node3 containers]# docker rm -f docker ps -a | awk '{print $1}' | grep -v 5930f740d83d | grep -v CONTAINER
—删除多余的镜像
[root@linux-node3 ~]# /etc/init.d/filebeat start
Starting filebeat (via systemctl): [ OK ]
[root@linux-node3 ~]# for i in {1…10};do curl 127.0.0.1;done 产生日志
成功!
[root@linux-node5 ~]#docker run -d -p 24224:24224 -p 24224:24224/udp -v /fluentd_log:/fluentd_log fluent/fluentd 把本地的目录挂载到镜像里
改变docker 日志驱动
1.全局模式
[root@linux-node3 ~]# vim /etc/docker/daemon.json
{
“registry-mirrors”: [“https://mmdl1uza.mirror.aliyuncs.com”],
“cluster-store”: “consul://10.0.0.19:8500”,
“cluster-advertise”: “10.0.0.17:2375”,
“dns”: [“10.0.0.2”,“8.8.8.8”],
“log-driver”: “fluentd”, --添加这里
“log-opts”: { --添加以下
“fluentd-address”:“10.0.0.19:24224”,
“tag”: “linux-node5.example.com”
}
}
[root@linux-node3 ~]# systemctl daemon-reload
[root@linux-node3 ~]# systemctl restart docker.service
[root@linux-node3 ~]# /etc/init.d/filebeat stop
[root@linux-node5 ~]# rpm -vih filebeat-5.6.5-x86_64.rpm
[root@linux-node5 ~]# vim /etc/filebeat/filebeat.yml
- /fluentd_log/*.log
[root@linux-node5 ~]# /etc/init.d/filebeat start
Starting filebeat (via systemctl): [ OK ]
[root@linux-node3 ~]# docker run -it -p 80:80 nginx
[root@linux-node5 ~]# for i in {1…10};do curl 10.0.0.17;done 模拟日志输出