bekt/logspout-logstash

logspout-logstash

轻量级https://github.com/gliderlabs/logspout%E9%80%82%E9%85%8D%E5%99%A8%EF%BC%8C%E7%94%A8%E4%BA%8E%E9%80%9A%E8%BF%87UDP%E6%88%96TCP%E5%B0%86Docker%E5%AE%B9%E5%99%A8%E6%97%A5%E5%BF%97%E5%8F%91%E9%80%81%E8%87%B3https://github.com/elastic/logstash%E3%80%82%E6%9C%AC%E9%95%9C%E5%83%8F%E4%B8%BAhttps://github.com/looplab/logspout-logstash%E7%9A%84%E6%89%98%E7%AE%A1%E5%B7%A5%E4%BD%9C%E7%89%88%E6%9C%AC%E3%80%82

核心功能

1. 转发Docker容器日志至Logstash服务
2. 支持UDP和TCP两种传输协议
3. 轻量级设计，资源占用低
4. 与Docker生态无缝集成，需挂载Docker sock文件

使用场景

• Docker集群环境下的日志集中收集与管理
• ELK（Elasticsearch、Logstash、Kibana）日志分析栈的日志输入环节
• 容器化应用的日志监控与调试

配置说明

环境变量

• ROUTE_URIS: 指定Logstash服务的地址，格式为logstash://<logstash_host>:<port>（如logstash://logstash:5000）

卷挂载

• 需挂载Docker sock文件：/var/run/docker.sock:/var/run/docker.sock（用于读取容器日志）

部署示例

Docker Compose示例

yaml
version: "2"
services:
  logspout:
    image: bekt/logspout-logstash
    restart: on-failure
    environment:
      ROUTE_URIS: logstash://logstash:5000
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  logstash:
    image: logstash:2.3
    command: -f /opt/logstash/sample.conf
    volumes:
      - ./logstash/:/opt/logstash

  redis:
    image: redis
    restart: always

Logstash配置示例（logstash/sample.conf）

conf
input {
  udp {
    port  => 5000
    codec => json
  }
}

filter {
  if [docker][image] =~ /^logstash/ {
    drop { }
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }
  stdout { codec => rubydebug }
}