Logstash
约 210 字小于 1 分钟
ELK
2025-10-16
部署指南
Logstash 是一个开源的服务器端数据处理管道，能够同时从多个来源采集数据，转换数据，然后将数据发送到您最喜欢的“存储库”中（通常是 Elasticsearch）。
准备工作
创建用于存储数据和配置的持久化目录：
mkdir -p /share/Container/logstash/data
mkdir -p /share/Container/logstash/pipeline创建默认的 pipeline 配置文件 logstash.conf：
cat <<EOF > /share/Container/logstash/pipeline/logstash.conf
input {
beats {
port => 5044
}
}
output {
stdout {
codec => rubydebug
}
# elasticsearch {
# hosts => ["http://elasticsearch:9200"]
# index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
# }
}
EOF启动服务
Docker Compose
services:
logstash:
image: bitnami/logstash:latest
container_name: logstash
restart: always
ports:
- "5044:5044"
- "9600:9600"
volumes:
- /share/Container/logstash/data:/bitnami/logstash
- /share/Container/logstash/pipeline:/opt/bitnami/logstash/pipeline
# environment:
# - LS_JAVA_OPTS=-Xmx256m -Xms256m
# networks:
# - elk-netDocker CLI
docker run -d \
--name logstash \
--restart always \
-p 5044:5044 \
-p 9600:9600 \
-v /share/Container/logstash/data:/bitnami/logstash \
-v /share/Container/logstash/pipeline:/opt/bitnami/logstash/pipeline \
bitnami/logstash:latest