用ELK管理Docker Container应用程序log

Posted 2021-04-21 仗剑走云端

背景知识

ELK典型架构

Logstash广泛用途和组件

Logstash高级应用架构

典型应用案例

1.#EnableRsyslogService

Addbelow to /etc/rsyslog.conf

$ModLoadimtcp

$InputTCPServerRun514

*.*@@localhost:4560

Load imtcp moduleand listen 514 and forward log data to 4560 port

systemctlrsyslogrestart

Usingnetstat -tnl tocheck if 514 port is listening

2.Deploy ElasticSearchService

dockerrun -itd--privileged -v /var/www/esdata/:/usr/share/elasticsearch/data/--name psm-es01 -p9200:9200 -p 9300:9300 elasticsearch

3.Deploy LogStashService

Addbelow to /etc/logstash/conf.d/logstash.conf

input{

syslog{

type=> "rsyslog"

port=> 4560

}

}

output{

elasticsearch {

hosts=> [ ”es.ocloudlab.com:9200"]

dockerrun -d -p 4560:4560 -v /etc/logstash/conf.d/logstash.conf:/etc/logstash.conf--link psm-es01:es.ocloudlab.com--namepsm-logstash01 logstashlogstash -f/etc/logstash.conf

4.Deploy Kibana Service

dockerrun -d -p 5601:5601 --link psm-es01:es.ocloudlab.com-eELASTICSEARCH_URL=http://es.ocloudlab.com:9200 --name psm-kibana01 kibana

5.Startup nginx container application

dockerrun -d -p 80:80 --log-driver syslog --log-opt syslog-address=tcp://localhost:514--log-opt tag="nginx"--name nginxnginx