docker+kibana+filebeat的安装

安装filebeat服务(在需要收集日志的主机安装filebeat)

下载和安装key文件

rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch

创建yum源文件（版本要和elasticsearch和kibana一样）

[root@localhost ~]# vim /etc/yum.repos.d/elk-elasticsearch.repo
[elastic-5.x]
name=Elastic repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

 

开始安装并启动服务

yum install filebeat
systemctl start filebeat
systemctl status filebeat

 

 

收集日志

[root@localhost ~]# grep "^\s*[^# \t].*$" /etc/filebeat/filebeat.yml 
filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /var/xxx/*.log
    - /var/xxx/*.out
  multiline.pattern: ^\[   //multiline这三行是读取多行日志的，不把注释去掉，在kibana查看日志格式会很乱
  multiline.negate: true   //false改为true
  multiline.match: after
setup.kibana:
  host: "192.168.1.191:5601"
output.elasticsearch:
  hosts: ["192.168.1.191:9200"]

 　　或

filebeat.prospectors:
- input_type: log
  paths:
    - /opt/*/logs/*info.log
    - /opt/*/logs/*error.log
  fields_under_root: true
  fields: //自定义主机ip字段
    ip: 192.168.81.132
  multiline.pattern: '^\[[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after
output.elasticsearch:
  hosts: ["192.168.81.141:9200"]

 

重启服务

systemctl restart filebeat

 

 

安装Kibana

安装

docker pull docker.io/kibana:5.6.12
docker run -it -d -e ELASTICSEARCH_URL=http://192.168.1.191:9200 --name kibana --restart=always -p 5601:5601 kibana:5.6.12

 新版本的 kibana 官方已经支持中文，配置文件中配置即可

grep -Ev "^#|^$" /etc/kibana/kibana.yml

server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://localhost:9200"]
pid.file: /tmp/kibana.pid
i18n.locale: "zh-CN"