docker-搭建efk收集docker日志

  1. 新建docker-compose.yml文件
    version: '2'
    services:
      fluentd:
        build: ./fluentd
        volumes:
          - ./fluentd/conf:/fluentd/etc
        links:
          - "elasticsearch"
        ports:
          - "24224:24224"
          - "24224:24224/udp"
    
      elasticsearch:
        image: elasticsearch
        volumes: 
          - ./es/data:/usr/share/elasticsearch/data        
        expose:
          - 9200
        ports:
          - "9200:9200"
    
      kibana:
        image: kibana
        volumes: 
          - ./kibana/plugins/:/usr/share/kibana/plugins/  
        links:
          - "elasticsearch"
        ports:
          - "5601:5601"
  2. 新建新建 fluentd 目录,在fluentd目录下新建Dockerfile文件
    FROM fluent/fluentd:v0.12-debian
    RUN ["gem", "install", "fluent-plugin-elasticsearch", "--no-rdoc", "--no-ri", "--version", "1.9.2"]

    在fluentd目录下 新建conf/fluent.conf

    <source>
      @type forward
      port 24224
      bind 0.0.0.0
    source>
    <match *.**>
      @type copy
      <store>
        @type elasticsearch
        host elasticsearch
        port 9200
        logstash_format true
        logstash_prefix fluentd
        logstash_dateformat %Y%m%d
        include_tag_key true
        type_name access_log
        tag_key @log_name
        flush_interval 1s
      store>
      <store>
        @type stdout
      store>
    match>
  3. docker-compose up -d 启动即可  然后配置 docker/swarm daemon.json内容 修改
    "log-driver":"fluentd",
    "log-opts":{
     "fluentd-address":"192.168.0.133:24224"
    },

    注意,此时如果fluentd服务挂了 服务启动不起来的,可以在服务启动时候 加上 --log-opt=fluentd-async-connect

  4. 具体详情请参照官方文档   https://docs.fluentd.org/v0.12/articles/docker-logging-efk-compose

转载于:https://www.cnblogs.com/1ssqq1lxr/p/9571374.html

你可能感兴趣的:(docker-搭建efk收集docker日志)