docker部署logstash

1、下载镜像

[root@vanje-dev01 ~]# docker pull logstash:7.0.1

2、安装部署

  2.1  创建宿主映射目录

# mkdir /etc/logstash/

# mkdir /etc/logstash/conf.d

  2.2 编辑配置文件

# vim /etc/logstash/logstash.yml

 http.host: "0.0.0.0"

# touch /etc/logstash/patterns

# chown -R 1000:1000 /etc/logstash/

  2.3 启动

# docker run -d --name logstash \

-p 5044:5044 -p 9600:9600 \

--net=host --restart=always \

-v /home/logstash:/usr/share/logstash \

logstash:7.1.1

目录映射说明：

　　1、/etc/logstash/logstash.yml：logstash启动配置文件

　　2、/etc/logstash/conf.d： logstash过滤日志规则

　　3、/etc/logstash/patterns： 自定义匹配规则

生产中为了保证elk集群的稳定性，Logstash作为日志的解析分割，一般都会在前面添加redis或者kafka集群。

springcloud+logback+logstash+rabbitmq

pom

        

        

            org.springframework.amqp

            spring-rabbit

        

        

            org.springframework.boot

            spring-boot-starter-amqp

        

logback-spring.xml配置

<?xml version="1.0" encoding="UTF-8"?>

%highlight(%d{yyyy-MM-dd HH:mm:ss.SSS}) %boldYellow([%thread]) %-5level %logger{36}- %msg%n

${LOG_HOME}/jeecgboot-system-%d{yyyy-MM-dd}.log

7

%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{50}:%L - %msg%n

ERROR

%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{50}:%L - %msg%n

${LOG_HOME}/error-log-%d{yyyy-MM-dd}.log

7

    

    

              class="org.springframework.amqp.rabbit.logback.AmqpAppender">

        

            %n ]]>

        

        

        192.168.0.20:5670

        36

        true

        system

        admin

        admin

        

        

        

        

        system

        true

        UTF-8

        true

        NON_PERSISTENT

        true

        false

    

    

    

    

    

    

    

    

        

        

        

        

        

    

Logstash 配置

vi /home/logstash/config/conf.d/system-log.conf

input {

   rabbitmq {

       type =>"all"

       durable => true

       exchange => "logs"

           exchange_type => "topic"

           key => "system"

           host => "192.168.0.20:5670"

#          port => 5670

           user => "admin"

           password => "admin"

           queue => "system-mq"

       auto_delete => false

  }

 }

output {

  elasticsearch {

       hosts => ["192.168.0.23:9200"]

           index => "system_log_mq"

           }