无法通过 gelf 驱动程序将 docker 容器连接到日志存储

Question

大家好，我在将服务器容器日志发送到我的 ELK 堆栈时遇到了问题。没有输入发送到日志，因此我无法设置 kibana 索引来收集日志。我认为我的问题出在端口设置中。

以下是 LAMP 堆栈(仅限服务器服务(的 docker-compose yml：

version: '3'
services:
  server:
    build: ./docker/apache
    links:
      - fpm
    ports:
      - 80:80 # HTTP
      - 443:443 # HTTPS
    logging:
      driver: "gelf"
      options:
        gelf-address: "udp://127.0.0.1:5000"
        tag: "server"

这是 ELK 堆栈的 docker-compose yml，基于 deviantony/docker-elk github 项目

version: '2'
services:
  elasticsearch:
    build: elasticsearch/
    volumes:
      - ./elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      ES_JAVA_OPTS: "-Xmx256m -Xms256m"
    networks:
      - elk
  logstash:
    build: logstash/
    volumes:
      - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml
      - ./logstash/pipeline:/usr/share/logstash/pipeline
    ports:
      - "5000:5000"
    environment:
      LS_JAVA_OPTS: "-Xmx256m -Xms256m"
    networks:
      - elk
    depends_on:
      - elasticsearch
  kibana:
    build: kibana/
    volumes:
      - ./kibana/config/:/usr/share/kibana/config
    ports:
      - "5601:5601"
    networks:
      - elk
    depends_on:
      - elasticsearch
networks:
  elk:
    driver: bridge

Answer 1

我发现了错误，我必须在logstash服务端口定义中指定UDP协议。

logstash:
  build: logstash/
  volumes:
    - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml
    - ./logstash/pipeline:/usr/share/logstash/pipeline
  ports:
    - "5000:5000/udp"
  environment:
    LS_JAVA_OPTS: "-Xmx256m -Xms256m"
  networks:
    - elk
  depends_on:
    - elasticsearch

Answer 2

您需要使用 gelf 输入插件。下面是一个功能正常的撰写文件的示例：

services:
  logstash:
    image: docker.elastic.co/logstash/logstash:5.3.1
    logging:
      driver: "json-file"
    networks:
      - logging
    ports:
      - "127.0.0.1:12201:12201/udp"
    entrypoint: logstash -e 'input { gelf { } } output { stdout{ } }'    

您可以通过运行以下命令来测试它：

docker run --log-driver=gelf --log-opt gelf-address=udp://127.0.0.1:12201 ubuntu /bin/sh -c 'while true; do date "+%d-%m-%Y %H:%M:%S:%3N"; sleep 1 ; done

并检查 logstash 容器上的 docker 日志。