docker收集日志到es并展示

1、安装es

?

1 2 3 4 5 6 7 8 9

注意：关闭xpack.security.enabled: false 权限认证       允许跨域        http.cors.enabled: true        http.cors.allow-origin: "* https://blog.csdn.net/qq_40739917/article/details/131654563 docker run --name elasticsearch -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -d elasticsearch:8.8.1 docker exec -it elasticsearch bash cd /usr/share/elasticsearch/config docker cp elasticsearch.yml elasticsearch:/usr/share/elasticsearch/config/

2、自己手动打包filebeat

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

#下载程序包 wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.10.3-linux-x86_64.tar.gz #修改配置文件 [root@localhost filebeat]# cat filebeat.yml filebeat.config:   modules:     path: ${path.config}/modules.d/*.yml     reload.enabled: false   processors: - add_cloud_metadata: ~ - add_docker_metadata: ~   filebeat.inputs: - type: log   enabled: true   paths:    - /var/lib/docker/containers/*/*-json.log   output.elasticsearch:   allow_older_versions: true  #允许使用older的es   hosts: '100.98.100.186:9200'     #创建dockerfile [root@localhost filebeat]# cat dockerfile FROM centos MAINTAINER wukc ADD localtime /etc/localtime RUN echo 'Asia/Shanghai'>/etc/timezone ADD filebeat /filebeat WORKDIR /filebeat EXPOSE 80 CMD ["/filebeat/filebeat"] #构建images docker build -t filebeat:8.10.3 . #运行容器 docker run -d --name=filebeat --restart=always -v /var/lib/docker/containers/:/var/lib/docker/containers/  filebeat:8.10.3 docker run -it --rm filebeat:8.10.3 bash  #调试运行方法 #备份images docker push wukc/filebeat:8.10.3

3、#查询索引内容

?

1 2 3 4 5

curl -XGET http://100.98.100.186:9200/.ds-filebeat-8.10.3-2023.10.31-000001/_search -H 'Content-Type: application/json' -d ' { "query": { "match_all": {} }

4、安装es的dashboard

?

1 2	docker run --restart=unless-stopped -d -p 8090:8090 kecikeci/elastic_view:latest http://100.98.100.186:8090 admin/admin

5、结果展示