docker 容器日志集中 ELK

ELK 基于 ovr 網絡下

?

?

?

?

?

docker-compose.yaml

version: '2' networks:network-test:external:name: ovr0 services:elasticsearch:image: elasticsearchnetwork-test:external:hostname: elasticsearchcontainer_name: elasticsearchrestart: alwaysvolumes:- /opt/elasticsearch/data:/usr/share/elasticsearch/datakibana:image: kibananetwork-test:external: hostname: kibanacontainer_name: kibanarestart: alwaysenvironment:ELASTICSEARCH_URL: http://elasticsearch:9200/ports:- 5601:5601logstash:image: logstashnetwork-test:external:hostname: logstashcontainer_name: logstashrestart: alwaysvolumes:- /opt/logstash/conf:/opt/logstash/confcommand: logstash -f /opt/logstash/conf/filebeat:image: prima/filebeatnetwork-test:external:hostname: filebeatcontainer_name: filebeatrestart: alwaysvolumes:- /opt/filebeat/conf/filebeat.yml:/filebeat.yml- /opt/upload:/data/logs- /opt/filebeat/registry:/etc/registry

?

?

filebeat說明:
filebeat.yml 掛載為 filebeat 的配置文件
logs 為 容器掛載日志的目錄
registry 讀取日志的記錄，防止filebeat 容器掛掉，需要重新讀取所有日志

?

logstash 配置文件如下：

第一種： 使用 patterns .

logstash.conf： (配置了二種輸入模式， filebeats, syslog) ??

?

input {beats {port => 5044type => beats}tcp {port => 5000type => syslog}}filter {if[type] == "tomcat-log" {multiline {patterns_dir => "/opt/logstash/conf/patterns"pattern => "(^%{TOMCAT_DATESTAMP})|(^%{CATALINA_DATESTAMP})"negate => truewhat => "previous"}if "ERROR" in [message] { #如果消息里有ERROR字符則將type改為自定義的標記mutate { replace => { type => "tomcat_catalina_error" } }}else if "WARN" in [message] {mutate { replace => { type => "tomcat_catalina_warn" } }}else if "DEBUG" in [message] {mutate { replace => { type => "tomcat_catalina_debug" } }}else {mutate { replace => { type => "tomcat_catalina_info" } }}grok{patterns_dir => "/opt/logstash/conf/patterns"match => [ "message", "%{TOMCATLOG}", "message", "%{CATALINALOG}" ]remove_field => ["message"] #這表示匹配成功后是否刪除原始信息，這個看個人情況，如果為了節省空間可以考慮刪除}date {match => [ "timestamp", "yyyy-MM-dd HH:mm:ss,SSS Z", "MMM dd, yyyy HH:mm:ss a" ]}} if[type] == "nginx-log" {if '"status":"404"' in [message] {mutate { replace => { type => "nginx_error_404" } }}else if '"status":"500"' in [message] {mutate { replace => { type => "nginx_error_500" } }}else if '"status":"502"' in [message] {mutate { replace => { type => "nginx_error_502" } }}else if '"status":"403"' in [message] {mutate { replace => { type => "nginx_error_403" } }}else if '"status":"504"' in [message] {mutate { replace => { type => "nginx_error_504" } }}else if '"status":"200"' in [message] {mutate { replace => { type => "nginx_200" } }}grok {remove_field => ["message"] #這表示匹配成功后是否刪除原始信息，這個看個人情況，如果為了節省空間可以考慮刪除}} }output {elasticsearch { hosts => ["elasticsearch:9200"]}#stdout { codec => rubydebug } #輸出到屏幕上 }

?

/opt/logstash/conf/patterns ?下面存放 grok 文件

grok-patterns:

USERNAME [a-zA-Z0-9._-]+ USER %{USERNAME} INT (?:[+-]?(?:[0-9]+)) BASE10NUM (?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+))) NUMBER (?:%{BASE10NUM}) BASE16NUM (?<![0-9A-Fa-f])(?:[+-]?(?:0x)?(?:[0-9A-Fa-f]+)) BASE16FLOAT \b(?<![0-9A-Fa-f.])(?:[+-]?(?:0x)?(?:(?:[0-9A-Fa-f]+(?:\.[0-9A-Fa-f]*)?)|(?:\.[0-9A-Fa-f]+)))\bPOSINT \b(?:[1-9][0-9]*)\b NONNEGINT \b(?:[0-9]+)\b WORD \b\w+\b NOTSPACE \S+ SPACE \s* DATA .*? GREEDYDATA .* QUOTEDSTRING (?>(?<!\\)(?>"(?>\\.|[^\\"]+)+"|""|(?>'(?>\\.|[^\\']+)+')|''|(?>`(?>\\.|[^\\`]+)+`)|``)) UUID [A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}# Networking MAC (?:%{CISCOMAC}|%{WINDOWSMAC}|%{COMMONMAC}) CISCOMAC (?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4}) WINDOWSMAC (?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2}) COMMONMAC (?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2}) IPV6 ((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)? IPV4 (?<![0-9])(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))(?![0-9]) IP (?:%{IPV6}|%{IPV4}) HOSTNAME \b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b) HOST %{HOSTNAME} IPORHOST (?:%{HOSTNAME}|%{IP}) HOSTPORT (?:%{IPORHOST=~/\./}:%{POSINT})# paths PATH (?:%{UNIXPATH}|%{WINPATH}) UNIXPATH (?>/(?>[\w_%!$@:.,-]+|\\.)*)+ TTY (?:/dev/(pts|tty([pq])?)(\w+)?/?(?:[0-9]+)) WINPATH (?>[A-Za-z]+:|\\)(?:\\[^\\?*]*)+ URIPROTO [A-Za-z]+(\+[A-Za-z+]+)? URIHOST %{IPORHOST}(?::%{POSINT:port})? # uripath comes loosely from RFC1738, but mostly from what Firefox # doesn't turn into %XX URIPATH (?:/[A-Za-z0-9$.+!*'(){},~:;=@#%_\-]*)+ #URIPARAM \?(?:[A-Za-z0-9]+(?:=(?:[^&]*))?(?:&(?:[A-Za-z0-9]+(?:=(?:[^&]*))?)?)*)? URIPARAM \?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]]* URIPATHPARAM %{URIPATH}(?:%{URIPARAM})? URI %{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?# Months: January, Feb, 3, 03, 12, December MONTH \b(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\b MONTHNUM (?:0?[1-9]|1[0-2]) MONTHDAY (?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])# Days: Monday, Tue, Thu, etc... DAY (?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)# Years? YEAR (?>\d\d){1,2} HOUR (?:2[0123]|[01]?[0-9]) MINUTE (?:[0-5][0-9]) # '60' is a leap second in most time standards and thus is valid. SECOND (?:(?:[0-5][0-9]|60)(?:[:.,][0-9]+)?) TIME (?!<[0-9])%{HOUR}:%{MINUTE}(?::%{SECOND})(?![0-9]) # datestamp is YYYY/MM/DD-HH:MM:SS.UUUU (or something like it) DATE_US %{MONTHNUM}[/-]%{MONTHDAY}[/-]%{YEAR} DATE_EU %{MONTHDAY}[./-]%{MONTHNUM}[./-]%{YEAR} ISO8601_TIMEZONE (?:Z|[+-]%{HOUR}(?::?%{MINUTE})) ISO8601_SECOND (?:%{SECOND}|60) TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}? DATE %{DATE_US}|%{DATE_EU} DATESTAMP %{DATE}[- ]%{TIME} TZ (?:[PMCE][SD]T|UTC) DATESTAMP_RFC822 %{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ} DATESTAMP_OTHER %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR}# Syslog Dates: Month Day HH:MM:SS SYSLOGTIMESTAMP %{MONTH} +%{MONTHDAY} %{TIME} PROG (?:[\w._/%-]+) SYSLOGPROG %{PROG:program}(?:\[%{POSINT:pid}\])? SYSLOGHOST %{IPORHOST} SYSLOGFACILITY <%{NONNEGINT:facility}.%{NONNEGINT:priority}> HTTPDATE %{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{INT}# Shortcuts QS %{QUOTEDSTRING}# Log formats SYSLOGBASE %{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}: COMMONAPACHELOG %{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) COMBINEDAPACHELOG %{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}# Log Levels LOGLEVEL ([A-a]lert|ALERT|[T|t]race|TRACE|[D|d]ebug|DEBUG|[N|n]otice|NOTICE|[I|i]nfo|INFO|[W|w]arn?(?:ing)?|WARN?(?:ING)?|[E|e]rr?(?:or)?|ERR?(?:OR)?|[C|c]rit?(?:ical)?|CRIT?(?:ICAL)?|[F|f]atal|FATAL|[S|s]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)# Java Logs JAVATHREAD (?:[A-Z]{2}-Processor[\d]+) JAVACLASS (?:[a-zA-Z0-9-]+\.)+[A-Za-z0-9$]+ JAVAFILE (?:[A-Za-z0-9_.-]+) JAVASTACKTRACEPART at %{JAVACLASS:class}\.%{WORD:method}\(%{JAVAFILE:file}:%{NUMBER:line}\) JAVALOGMESSAGE (.*) # MMM dd, yyyy HH:mm:ss eg: Jan 9, 2014 7:13:13 AM CATALINA_DATESTAMP %{MONTH} %{MONTHDAY}, 20%{YEAR} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) (?:AM|PM) # yyyy-MM-dd HH:mm:ss,SSS ZZZ eg: 2014-01-09 17:32:25,527 -0800 TOMCAT_DATESTAMP 20%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) %{ISO8601_TIMEZONE} CATALINALOG %{CATALINA_DATESTAMP:timestamp} %{JAVACLASS:class} %{JAVALOGMESSAGE:logmessage} # 2014-01-09 20:03:28,269 -0800 | ERROR | com.example.service.ExampleService - something compeletely unexpected happened... TOMCATLOG %{TOMCAT_DATESTAMP:timestamp} \| %{LOGLEVEL:level} \| %{JAVACLASS:class} - %{JAVALOGMESSAGE:logmessage}

?

?

?

?

?

?

?

下面我們配置 容器日志輸出：

docker里，標準的日志方式是用Stdout, docker 里面配置標準輸出，只需要指定： syslog 就可以了。

對于 stdout 標準輸出的 docker 日志，我們使用 logstash 來收集日志就可以。

我們在 docker-compose 中配置如下既可：

logging:driver: syslogoptions:syslog-address: 'tcp://logstash:5000'

但是一般來說我們都是文件日志，那么我們就可以直接用filebeat

對于 filebeat 我們使用 官方的 dockerhub 的 prima/filebeat 鏡像。

官方的鏡像中，我們需要編譯一個filebeat.yml 文件， 官方說明中有兩種方案：

第一是 -v 掛載 -v /path/filebeat.yml:/filebeat.yml

第二是 dockerfile 的時候

FROM prima/filebeatCOPY filebeat.yml /filebeat.yml

編譯一個 filebeat.yml 文件。

filebeat.yml 支持單一路徑的 prospector， 也支持多個 prospector或者每個prospector多個路徑。

paths 可使用多層匹配， 如： /var/log/messages* , /var/log/* , /opt/nginx/*/*.log

例：

filebeat:prospectors:-paths:- "/data/logs/catalina.*.out"input_type: filebeat-logdocument_type: tomcat-log- paths:- "/data/logs/nginx*/logs/*.log"input_type: filebeat-logdocument_type: nginx-logregistry_file: /etc/registry/markoutput:logstash:hosts: ["logstash:5044"]logging:files:rotateeverybytes: 10485760 # = 10MB

?

filebeat 需要在每臺需要采集的機器上面都啟動一個容器。

執行 docker-compose up -d 查看啟動的 容器

?

加載 filebeat 模板進入 elasticsearch 容器中 ( docker exec -it elasticsearch bash )curl -O https://gist.githubusercontent.com/thisismitch/3429023e8438cc25b86c/raw/d8c479e2a1adcea8b1fe86570e42abab0f10f364/filebeat-index-template.jsoncurl -XPUT 'http://elasticsearch:9200/_template/filebeat?pretty' -d@filebeat-index-template.json

filebeat-index-template.json

{"mappings": {"_default_": {"_all": {"enabled": true,"norms": {"enabled": false}},"dynamic_templates": [{"template1": {"mapping": {"doc_values": true,"ignore_above": 1024,"index": "not_analyzed","type": "{dynamic_type}"},"match": "*"}}],"properties": {"@timestamp": {"type": "date"},"message": {"type": "string","index": "analyzed"},"offset": {"type": "long","doc_values": "true"},"geoip" : {"type" : "object","dynamic": true,"properties" : {"location" : { "type" : "geo_point" }}}}}},"settings": {"index.refresh_interval": "5s"},"template": "filebeat-*" }

訪問 http://kibana-IP:5601 可以看到已經出來 kibana 了，但是還沒有數據

?

啟動一個 nginx 容器

docker-compose

nginx:image: alpine-nginxnetworks:network-test:hostname: nginxcontainer_name: nginxrestart: alwaysports:- 80:80volumes:- /opt/upload/nginx/conf/vhost:/etc/nginx/vhost- /opt/upload/nginx/logs:/opt/nginx/logs

?

本地目錄 /opt/upload/nginx ? 必須掛載到?filebeat 容器里面，讓filebeat 可以采集到。

?

?

?

?

可以看到 kibana 已經有數據出來了

?

轉載于:https://www.cnblogs.com/jicki/p/5913622.html

總結

以上是生活随笔為你收集整理的docker 容器日志集中 ELK + filebeat的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。