ELK根据服务类型收集多个容器数据

转载来源 ：ELK根据服务类型收集多个容器数据 : https://www.jianshu.com/p/29ad69776ae5

1.安装docker-compose

yum install -y python2-pip ##安装pip工具
pip install -i https://pypi.tuna.tsinghua.edu.cn/simple pip -U ##下载加速器
pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple ##使用加速器
pip install docker-compose ##使用pip工具安装docker-compose

2.编辑compose文件

[root@db02 ~]# cat docker-compose.yaml 
version: '3'
services:
  nginx:
    image: nginx:latest
    #设置labels
    labels:
      service: game
    # logging设置增加lables.service
    logging:
      options:
        labels: "service"
    ports:
      - "8080:80"
  db:
    image: nginx:latest
    # 设置lables
    labels:
      service: school
    # logging设置增加lables.service
    logging:
      options:
        labels: "service"
    ports:
      - "80:80"

3.使用docker-compose启动容器

[root@db02 ~]# docker-compose up & ##启动容器并放入后台
[root@db02 ~]# docker ps -a ##查看容器启动情况
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                  NAMES
20cb4626d034        nginx:latest        "/docker-entrypoint.…"   36 seconds ago      Up 22 seconds       0.0.0.0:80->80/tcp     root_db_1
ab5c8bb167df        nginx:latest        "/docker-entrypoint.…"   36 seconds ago      Up 23 seconds       0.0.0.0:8080->80/tcp   root_nginx_1

4.修改kibana配置文件并重启filebeat

[root@db02 ~]# cat /etc/filebeat/filebeat.yml 
filebeat.inputs:
- type: log
  paths:
    - /var/lib/docker/containers/*/*-json.log
  json.keys_under_root: true
  json.overwrite_keys: true

setup.kibana:
  host: "172.16.210.53:5601"

output.elasticsearch:
  hosts: ["172.16.210.53:9200"]
  indices:
  - index: "docker-game-access-%{[beat.version]}-%{+yyyy.MM}"
    when.contains:
      attrs.service: "game"
      stream: "stdout"

  - index: "docker-game-error-%{[beat.version]}-%{+yyyy.MM}"
    when.contains:
      attrs.service: "game"
      stream: "stderr"

  - index: "docker-school-access-%{[beat.version]}-%{+yyyy.MM}"
    when.contains:
      attrs.service: "school"
      stream: "stdout"

  - index: "docker-school-error-%{[beat.version]}-%{+yyyy.MM}"
    when.contains:
      attrs.service: "school"
      stream: "stderr"

setup.template.name: "docker"
setup.template.pattern: "docker-*"
setup.template.enabled: false
setup.template.overwrite: true
[root@db02 ~]# systemctl restart filebeat

5.回到kibana界面依次添加索引

点击discover,查看数据