使用Filebeat和Logstash记录的Docker应用 [英] Docker apps logging with Filebeat and Logstash

问题描述

我有一组分散在多台服务器上的dockerized应用程序，并尝试使用ELK设置生产级别的集中式日志记录.我对ELK部分本身没问题，但是对于如何将日志转发到我的日志我有些困惑. 我正在尝试使用Filebeat，因为它具有负载平衡功能. 我还想避免将Filebeat(或其他任何东西)打包到我的所有docker中，并使其分开，是否被dockerized.

I have a set of dockerized applications scattered across multiple servers and trying to setup production-level centralized logging with ELK. I'm ok with the ELK part itself, but I'm a little confused about how to forward the logs to my logstashes. I'm trying to use Filebeat, because of its loadbalance feature. I'd also like to avoid packing Filebeat (or anything else) into all my dockers, and keep it separated, dockerized or not.

我该如何进行?

我一直在尝试以下方法.我的Docker登录到stdout，因此将非dockerized Filebeat配置为从stdin读取，我可以这样做:

I've been trying the following. My Dockers log on stdout so with a non-dockerized Filebeat configured to read from stdin I do:

docker日志-f mycontainer | ./filebeat -e -c filebeat.yml

docker logs -f mycontainer | ./filebeat -e -c filebeat.yml

这似乎在一开始就起作用.第一个日志转发到我的logstash.我猜是缓存的.但是在某些时候，它会卡住并继续发送相同的事件

That appears to work at the beginning. The first logs are forwarded to my logstash. The cached one I guess. But at some point it gets stuck and keep sending the same event

这只是一个错误还是我走错了方向?您设置了什么解决方案?

Is that just a bug or am I headed in the wrong direction? What solution have you setup?

推荐答案

Docker允许您指定 logDriver 正在使用.此答案与Filebeat或负载平衡无关.

Docker allows you to specify the logDriver in use. This answer does not care about Filebeat or load balancing.

在演示中，我使用syslog将日志转发到侦听端口5000的Logstash(ELK)实例. 以下命令不断通过syslog将消息发送到Logstash:

In a presentation I used syslog to forward the logs to a Logstash (ELK) instance listening on port 5000. The following command constantly sends messages through syslog to Logstash:

docker run -t -d --log-driver=syslog --log-opt syslog-address=tcp://127.0.0.1:5000 ubuntu /bin/bash -c 'while true; do echo "Hello $(date)"; sleep 1; done'

这篇关于使用Filebeat和Logstash记录的Docker应用的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！