Docker安装logstash

docker pull logstash:7.6.2

修改Logstash的配置文件logstash.conf中output节点下的Elasticsearch连接地址为es:9200，配置文件地址：

input {
 tcp {
 mode => "server"
 host => "0.0.0.0"
 port => 4560
 codec => json_lines
type => "debug"
 }
 tcp {
 mode => "server"
 host => "0.0.0.0"
 port => 4561
 codec => json_lines
 type => "error"
 }
 tcp {
 mode => "server"
 host => "0.0.0.0"
 port => 4562
 codec => json_lines
 type => "business"
}
 tcp {
 mode => "server"
 host => "0.0.0.0

 port => 4563
codec => json_lines
type => "record"
 }
}
filter{
     if [type] == "record" {
         mutate {
         remove_field => "port"
         remove_field => "host"
        remove_field => "@version"
    }
     json {
         source => "message"
         remove_field => ["message"]
         }
     }
}
 output {
     elasticsearch {
         hosts => "192.168.50.66:9200"
         index => "mall‐%{type}‐%{+YYYY.MM.dd}"
     }
 }

创建/mydata/logstash目录，并将Logstash的配置文件logstash.conf拷贝到该目录；

mkdir /mydata/logstash

docker run --name logstash -p 4560:4560 -p 4561:4561 -p 4562:4562 -p 4563:4563 --link elasticsearch:es -v /mydata/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf -d logstash:7.6.2

进入容器内部安装插件

docker exec -it logstash/bin/bash;
logstash-plugin install logstash-codec-json_lines