khezen/logstash

khezen/logstash Docker镜像文档

支持的标签及对应Dockerfile链接

• 2.4.1, 2.4, 2 https://github.com/Khezen/docker-logstash/blob/2.4/Dockerfile
• 5.1.2, 5.1, 5, latest https://github.com/Khezen/docker-logstash/blob/5.0/Dockerfile

什么是Logstash？

Logstash是一个开源的服务器端数据处理管道，能够同时从多个来源摄取数据，对其进行转换，然后将其发送到您喜欢的“存储库”（例如Elasticsearch）。

[]([***]

如何使用

Docker引擎

bash
docker run -d -p 5000:5000 -p 5001:5001 khezen/logstash:latest

Docker Compose

文件描述符和MMap

在主机上运行以下命令：

bash
sysctl -w vm.max_map_count=262144

您可以通过修改/etc/sysctl.conf中的vm.max_map_count设置使其永久生效。

docker-compose.yml

yaml
version: '3'
services:
    elasticsearch:
        image: khezen/elasticsearch:2
        environment:
            ELASTIC_PWD: changeme
            KIBANA_PWD: brucewayne
            LOGSTASH_PWD: heizenberg
        volumes:
            - /data/elasticsearch:/usr/share/elasticsearch/data
            - /etc/elasticsearch:/usr/share/elasticsearch/config 
        ports:
             - "9200:9200"
             - "9300:9300"
        network_mode: bridge
        restart: unless-stopped
    
    kibana:
        links:
            - elasticsearch:elasticsearch-0
        image: khezen/kibana:4
        environment:
            KIBANA_PWD: brucewayne
            ELASTICSEARCH_HOST: elasticsearch-0
            ELASTICSEARCH_PORT: 9200
        volumes:
            - /etc/kibana:/opt/kibana/config
        ports:
             - "5601:5601"
        network_mode: bridge
        restart: unless-stopped

    logstash:
        links:
            - elasticsearch:elasticsearch-0
        image: khezen/logstash:2
        environment:
            LOGSTASH_PWD: heizenberg
            ELASTICSEARCH_HOST: elasticsearch-0
            ELASTICSEARCH_PORT: 9200
        volumes:
            - /etc/logstash:/etc/logstash/conf.d
            - /etc/elasticsearch/searchguard/ssl:/etc/elasticsearch/searchguard/ssl
        ports:
             - "5000:5000"
             - "5001:5001"
        network_mode: bridge
        restart: unless-stopped

环境变量

HEAP_SIZE | 1g

定义分配给Logstash的最大内存。

LOGSTASH_PWD | changeme

Elasticsearch内置用户logstash的密码。

ELASTICSEARCH_HOST | elasticsearch

Elasticsearch主机名。

ELASTICSEARCH_PORT | 9200

Elasticsearch端口。

TS_PWD | changeme

信任库密码。

默认配置

input {
	tcp {
		port => 5000
		codec => "json"
	}
	udp {
		port => 5001
		codec => "json"
	}
}

filter {
	date {
		match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
	}
	geoip {
    	source => "clientip"
 	}
  	useragent {
    	source => "agent"
    	target => "useragent"
  	}
}

output {
	elasticsearch {
		hosts => "${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}"
    user => "logstash"
    password => "${LOGSTASH_USER}"
		ssl => true
    ssl_certificate_verification => true
		truststore => "/etc/elasticsearch/searchguard/ssl/truststore.jks"
    truststore_password => "${TS_PWD}"
	}
}

配置Logstash

如果您按照上述docker-compose示例中的卷映射方式，配置文件位于/etc/logstash/logstash.conf。

您可以在https://github.com/Khezen/docker-logstash/blob/master/config/logstash.conf%E6%89%BE%E5%88%B0%E9%BB%98%E8%AE%A4%E9%85%8D%E7%BD%AE%E3%80%82

注意：可以在logstash.conf中使用环境变量。

您可以在此处获取Logstash配置帮助。

用户反馈

问题

如果您对该镜像有任何问题或疑问，请通过https://github.com/Khezen/docker-logstash/issues%E5%AF%BB%E6%B1%82%E5%B8%AE%E5%8A%A9%E3%80%82