用docker 跑 logstash节点 - kibana界面汉化 - logstash tcp

0.docker中logstash的配置文件

[root@VM_0_6_centos pipeline]# cat logstash.yml 
#http.host: "0.0.0.0"
#xpack.monitoring.elasticsearch.url: http://10.0.0.92:9200
可以定义成空，会有一下warn告警

1.首先写下最后的命令

 docker run --rm -it    -v /tmp/pipeline/messages:/usr/share/logstash/config/messages -v /tmp/pipeline/test.conf:
/usr/share/logstash/pipeline/test.conf -v /tmp/pipeline/logstash.yml:/usr/share/logstash/config/logstash.yml docker.elastic.co/logstash/logstash
:6.4.2

2.里面的坑

容器里面定义配置文件的地方

bash-4.2$ cat /usr/share/logstash/config/pipelines.yml

- pipeline.id: main
  path.config: "/usr/share/logstash/pipeline"

3.容器里最终起作用的配置文件的位置

cd /usr/share/logstash/pipeline
#################################/usr/share/logstash/pipeline
[root@VM_0_6_centos pipeline]# cat test.conf 
input {
    file {
        path => ["/usr/share/logstash/config/messages"]
        type => "nodelog"
    }
}

filter {
}
output {
    elasticsearch {
          hosts => ["10.0.0.92:9200"]
          index => "nodelog-%{+YYY.MM.dd}"
    }
    stdout {
codec => rubydebug
    }
}

4.权限问题：用户要修改成logstash

Bind-mounted configuration files will retain the same permissions and ownership within the container that they have on the
 host system. Be sure to set permissions such that the files will be readable and, ideally, 
not writeable by the container’s logstash user (UID 1000).

参考：https://www.jianshu.com/p/68ad2cede7c0

https://www.elastic.co/guide/en/logstash/current/docker-config.html#_pipeline_configuration

 

5.logstash tcp 配置

input {
  tcp {
    host => "0.0.0.0"
    port => 9250
    mode => "server"
    tags => ["tags"]
    codec => json_lines
  }
  stdin {
  }
}
output {
#  stdout {
#  codec => rubydebug
#  }
  elasticsearch {
    hosts => "10.0.0.9:9200"
  }
}