#启动服务docker-compose up -d#验证#测试标准的输入输出和输出到文件 logstash -e input { stdin {} } output{stdout{}} #输出到文件 logstash -e input { stdin {} } output { file { path /tmp/test-%{YYYY.MM.dd}.log} } #测试输出到elasticsearch logstash -e input { stdin {} } output { elasticsearch { hosts [192.168.10.14:9200] index logstash-test-%{YYYY.MM.dd} } } #查看es curl http://localhost:9200/_cat/indices\?v #/usr/share/logstash/data #rm -f .lock#部署filebeatdocker pull docker.elastic.co/beats/filebeat:8.6.0#临时启动filebeat 拷贝文件#启动 docker run -d --namefilebeat docker.elastic.co/beats/filebeat:8.6.0 #复制到宿主机 docker cp filebeat:/usr/share/filebeat /data/elk_monitor/#filebeat.yaml配置filebeat.inputs: - type: log enabled: true paths: - /var/log/messages/*.log setup.kibana: host: 192.168.10.14:5601 output.elasticsearch.allow_older_versions: true output.elasticsearch: hosts: 192.168.10.14:9200 indices: - index: filebeat-%{yyyy.MM.dd} #----------------------------- Logstash output -------------------------------- #output.logstash: # The Logstash hosts # hosts: 192.168.10.14:5044