無法通過gelf驅動程序將docker容器連接到logstash

Question

嗨，大家好，我很難將我的服務器容器日誌發送到我的ELK堆棧。沒有輸入發送到logstash，所以我無法設置收集日誌的kibana索引。我認爲我的問題是在端口設置。

下面是LAMP堆棧泊塢窗，撰寫陽明海運（僅服務器服務）：

version: '3' 

services: 
    server: 
    build: ./docker/apache 
    links: 
     - fpm 
    ports: 
     - 80:80 # HTTP 
     - 443:443 # HTTPS 
    logging: 
     driver: "gelf" 
     options: 
     gelf-address: "udp://127.0.0.1:5000" 
     tag: "server" 

這裏是麋鹿堆棧泊塢窗，撰寫陽明，基於deviantony/docker-elk github project

version: '2' 

services: 

    elasticsearch: 
    build: elasticsearch/ 
    volumes: 
     - ./elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml 
    ports: 
     - "9200:9200" 
     - "9300:9300" 
    environment: 
     ES_JAVA_OPTS: "-Xmx256m -Xms256m" 
    networks: 
     - elk 

    logstash: 
    build: logstash/ 
    volumes: 
     - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml 
     - ./logstash/pipeline:/usr/share/logstash/pipeline 
    ports: 
     - "5000:5000" 
    environment: 
     LS_JAVA_OPTS: "-Xmx256m -Xms256m" 
    networks: 
     - elk 
    depends_on: 
     - elasticsearch 

    kibana: 
    build: kibana/ 
    volumes: 
     - ./kibana/config/:/usr/share/kibana/config 
    ports: 
     - "5601:5601" 
    networks: 
     - elk 
    depends_on: 
     - elasticsearch 

networks: 

    elk: 
    driver: bridge 

Answer 1

我發現了錯誤，我必須在logstash服務端口定義中指定UDP協議。

logstash: 
    build: logstash/ 
    volumes: 
    - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml 
    - ./logstash/pipeline:/usr/share/logstash/pipeline 
    ports: 
    - "5000:5000/udp" 
    environment: 
    LS_JAVA_OPTS: "-Xmx256m -Xms256m" 
    networks: 
    - elk 
    depends_on: 
    - elasticsearch 

Answer 2

您需要使用gelf輸入插件。這裏一個正常運作的撰寫文件的一個例子：logstash容器上

docker run --log-driver=gelf --log-opt gelf-address=udp://127.0.0.1:12201 ubuntu /bin/sh -c 'while true; do date "+%d-%m-%Y %H:%M:%S:%3N"; sleep 1 ; done 

和檢查搬運工日誌：

services: 
    logstash: 
    image: docker.elastic.co/logstash/logstash:5.3.1 
    logging: 
     driver: "json-file" 
    networks: 
     - logging 
    ports: 
     - "127.0.0.1:12201:12201/udp" 
    entrypoint: logstash -e 'input { gelf { } } output { stdout{ } }'  

您可以通過運行測試。