需要使用docker 安装Logstash&＃xff0c;来收集文件/var/log/messages
环境说明
操作系统&＃xff1a;centos 7.6
docker版本&＃xff1a;19.03.12
ip地址&＃xff1a;192.168.31.190
二、安装
下载镜像
docker pull logstash:7.5.1
启动logstash
docker run -d --name&＃61;logstash logstash:7.5.1
等待30秒&＃xff0c;查看日志
docker logs -f logstash
如果出现以下信息&＃xff0c;说明启动成功。
[2020-08-26T08:12:01,224][INFO ][org.logstash.beats.Server] Starting server on port: 5044
[2020-08-26T08:12:01,722][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port&＃61;>9600}
创建持久化目录&＃xff0c;拷贝数据&＃xff0c;授予权限&＃xff0c;并重新启动
docker run -d --name&＃61;logstash logstash:7.5.1
mkdir -p /data/elk7/logstash/config/conf.d
docker cp logstash:/usr/share/logstash/config /data/elk7/logstash/
docker cp logstash:/usr/share/logstash/data /data/elk7/logstash/
docker cp logstash:/usr/share/logstash/pipeline /data/elk7/logstash/
chmod 777 -R /data/elk7/logstash
配置文件
请确保elasticsearch运行正常&＃xff0c;关于elasticsearch的安装&＃xff0c;请参考连接&＃xff1a;
https://www.cnblogs.com/xiao987334176/p/13565468.html
修改配置文件中的elasticsearch地址
vi /data/elk7/logstash/config/logstash.yml
完整内容如下&＃xff1a;
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: [ "http://192.168.31.190:9200" ]
path.config: /usr/share/logstash/config/conf.d/*.conf
path.logs: /usr/share/logstash/logs
注意&＃xff1a;请根据实际情况修改elasticsearch地址
新建文件syslog.conf&＃xff0c;用来收集/var/log/messages
vi /data/elk7/logstash/config/conf.d/syslog.conf
内容如下&＃xff1a;
input {file {#标签type &＃61;> "systemlog-localhost"#采集点path &＃61;> "/var/log/messages"#开始收集点start_position &＃61;> "beginning"#扫描间隔时间&＃xff0c;默认是1s&＃xff0c;建议5sstat_interval &＃61;> "5"}
}output {elasticsearch {hosts &＃61;> ["192.168.31.190:9200"]index &＃61;> "logstash-system-localhost-%{&＃43;YYYY.MM.dd}"}
}
重新启动logstash
docker rm -f logstashdocker run -d \--name&＃61;logstash \--restart&＃61;always \-v /data/elk7/logstash:/usr/share/logstash \-v /var/log/messages:/var/log/messages \logstash:7.5.1
重启完成之后&＃xff0c;访问elasticsearch-head
确保创建了索引
京公网安备 11010802041100号