elk

filebeats

• 官网

docker pull docker.elastic.co/beats/filebeat:8.5.2

• 下载示例配置

curl -L -O https://raw.githubusercontent.com/elastic/beats/8.5/deploy/docker/filebeat.docker.yml

• 启动filebeats

docker run \
docker.elastic.co/beats/filebeat:8.5.2 \
setup -E setup.kibana.host=kibana:5601 \
-E output.elasticsearch.hosts=["elasticsearch:9200"]  

• 挂载配置

docker run -d \
  --name=filebeat \
  --user=root \
  --volume="$(pwd)/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro" \
  --volume="/var/lib/docker/containers:/var/lib/docker/containers:ro" \
  --volume="/var/run/docker.sock:/var/run/docker.sock:ro" \
  docker.elastic.co/beats/filebeat:8.5.2 filebeat -e --strict.perms=false \
  -E output.elasticsearch.hosts=["elasticsearch:9200"]  

• 自定义镜像

FROM docker.elastic.co/beats/filebeat:8.5.2
COPY --chown=root:filebeat filebeat.yml /usr/share/filebeat/filebeat.yml