Docker 搭建 ELK 日志搜索平台

<Property name="LOG_PATTERN">%clr{%d{yyyy-MM-dd HH:mm:ss.SSS}}{faint} %clr{%5p} %clr{${sys:PID}}{magenta} %clr{---}{faint} %clr{[%15.15t]}{faint} %clr{%-40.40c{1.}}{cyan} %clr{:}{faint} %m%n%xwEx</Property>

<Property name="LOG_PATTERN">%d{yyyy-MM-dd HH:mm:ss.SSS} | %5p | ${sys:PID} | %15.15t | %-40.40c{1.} | %m%n%xwEx</Property>

docker pull elasticsearch

docker volume create elasticsearch_data

docker run \
-d \
-p 9200:9200 \
-v elasticsearch_data:/usr/share/elasticsearch/data \
--name elasticsearch \
elasticsearch

docker pull logstash

input {
  file {
    id => "spring-boot-info"
    path => [ "/Users/admin/code/log/*-info.log" ]
    type => "info"
    start_position => "beginning"
  }
  file {
    id => "spring-boot-error"
    path => [ "/Users/admin/code/log/*-error.log" ]
    type => "error"
    start_position => "beginning"
  }
}

filter {
  mutate {
    split => ["message", " | "]
    add_field => {
      "curr_time" => "%{[message][0]}"
    }
    add_field => {
      "level" => "%{[message][1]}"
    }
    add_field => {
      "pid" => "%{[message][2]}"
    }
    add_field => {
      "thread" => "%{[message][3]}"
    }
    add_field => {
      "class" => "%{[message][4]}"
    }
    add_field => {
      "content" => "%{[message]5[]}"
    }
  }
}

output{
  elasticsearch {
    hosts => [ "elasticsearch:9200" ]
    index => "logstash-%{type}-%{+YYYY.MM.dd}"
    document_type => "%{type}"
  }
}

docker run \
-d \
-p 4560:4560 \
-v /Users/admin/docker/logstash/logstash.conf:/etc/logstash.conf \
-v /Users/admin/code/log:/Users/admin/code/log \
--link elasticsearch:elasticsearch \
--name logstash \
logstash \
logstash -f /etc/logstash.conf

docker pull kibana

docker run \
-d \
-p 5601:5601 \
--link elasticsearch:elasticsearch \
-e ELASTICSEARCH_URL=http://elasticsearch:9200 \
--name kinaba \
kibana