无法通过gelf驱动程序将docker容器连接到logstash

Question

嗨，大家好，我很难将我的服务器容器日志发送到我的ELK堆栈。没有输入发送到logstash，所以我无法设置收集日志的kibana索引。我认为我的问题是在端口设置。

下面是LAMP堆栈泊坞窗，撰写阳明海运（仅服务器服务）：

version: '3' 

services: 
    server: 
    build: ./docker/apache 
    links: 
     - fpm 
    ports: 
     - 80:80 # HTTP 
     - 443:443 # HTTPS 
    logging: 
     driver: "gelf" 
     options: 
     gelf-address: "udp://127.0.0.1:5000" 
     tag: "server" 

这里是麋鹿堆栈泊坞窗，撰写阳明，基于deviantony/docker-elk github project

version: '2' 

services: 

    elasticsearch: 
    build: elasticsearch/ 
    volumes: 
     - ./elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml 
    ports: 
     - "9200:9200" 
     - "9300:9300" 
    environment: 
     ES_JAVA_OPTS: "-Xmx256m -Xms256m" 
    networks: 
     - elk 

    logstash: 
    build: logstash/ 
    volumes: 
     - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml 
     - ./logstash/pipeline:/usr/share/logstash/pipeline 
    ports: 
     - "5000:5000" 
    environment: 
     LS_JAVA_OPTS: "-Xmx256m -Xms256m" 
    networks: 
     - elk 
    depends_on: 
     - elasticsearch 

    kibana: 
    build: kibana/ 
    volumes: 
     - ./kibana/config/:/usr/share/kibana/config 
    ports: 
     - "5601:5601" 
    networks: 
     - elk 
    depends_on: 
     - elasticsearch 

networks: 

    elk: 
    driver: bridge 

Answer 1

我发现了错误，我必须在logstash服务端口定义中指定UDP协议。

logstash: 
    build: logstash/ 
    volumes: 
    - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml 
    - ./logstash/pipeline:/usr/share/logstash/pipeline 
    ports: 
    - "5000:5000/udp" 
    environment: 
    LS_JAVA_OPTS: "-Xmx256m -Xms256m" 
    networks: 
    - elk 
    depends_on: 
    - elasticsearch 

Answer 2

您需要使用gelf输入插件。这里一个正常运作的撰写文件的一个例子：logstash容器上

docker run --log-driver=gelf --log-opt gelf-address=udp://127.0.0.1:12201 ubuntu /bin/sh -c 'while true; do date "+%d-%m-%Y %H:%M:%S:%3N"; sleep 1 ; done 

和检查搬运工日志：

services: 
    logstash: 
    image: docker.elastic.co/logstash/logstash:5.3.1 
    logging: 
     driver: "json-file" 
    networks: 
     - logging 
    ports: 
     - "127.0.0.1:12201:12201/udp" 
    entrypoint: logstash -e 'input { gelf { } } output { stdout{ } }'  

您可以通过运行测试。