Docker系列教程28-实战：使用Docker Compose运行ELK

• ElasticSearch【存储】

• Logtash【日志聚合器】

• Kibana【界面】

答案：

1. version: '2'

2. services:

3. elasticsearch:

4.  image: elasticsearch

5.  # command: elasticsearch

6.  ports:

7.   - "9200:9200"   # REST API端口

8.   - "9300:9300"   # RPC端口

9. logstash:

10.  image: logstash

11.  command: logstash -f /etc/logstash/conf.d/logstash.conf

12.  volumes:

13.   - ./config:/etc/logstash/conf.d

14.   - /opt/build:/opt/build

15.  ports:

16.   - "5000:5000"

17. kibana:

18.  image: kibana

19.  environment:

20.   - ELASTICSEARCH_URL=http://elasticsearch:9200

21.  ports:

22.   - "5601:5601"

logstash.conf 参考示例：

1. input {

2.  file {

3.    codec => json

4.    path => "/opt/build/*.json"

5.  }

6. }

7. filter {

8.  grok {

9.    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span},%{DATA:exportable}\]\s+%{DATA:pid}---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:rest}" }

10.  }

11. }

12. output {

13.  elasticsearch {

14.    hosts => "elasticsearch:9200"

15.  }

16. }

参考文档

https://docs.docker.com/compose/samples-for-compose/#samples-tailored-to-demo-compose