docker-搭建efk收集docker日志

1. 新建docker-compose.yml文件

   version: '2'
   
   services:
   
     fluentd:
   
       build: ./fluentd
   
       volumes:
   
         - ./fluentd/conf:/fluentd/etc
   
       links:
   
         - "elasticsearch"
   
       ports:
   
         - "24224:24224"
   
         - "24224:24224/udp"
   
     elasticsearch:
   
       image: elasticsearch
   
       volumes:
   
         - ./es/data:/usr/share/elasticsearch/data
   
       expose:
   
         - 9200
   
       ports:
   
         - "9200:9200"
   
     kibana:
   
       image: kibana
   
       volumes:
   
         - ./kibana/plugins/:/usr/share/kibana/plugins/
   
       links:
   
         - "elasticsearch"
   
       ports:
   
         - "5601:5601"

2. 新建新建 fluentd 目录，在fluentd目录下新建Dockerfile文件

   FROM fluent/fluentd:v0.12-debian
   
   RUN ["gem", "install", "fluent-plugin-elasticsearch", "--no-rdoc", "--no-ri", "--version", "1.9.2"]

   在fluentd目录下 新建conf/fluent.conf

   <source>
   
     @type forward
   
     port 24224
   
     bind 0.0.0.0
   
   </source>
   
   <match *.**>
   
     @type copy
   
     <store>
   
       @type elasticsearch
   
       host elasticsearch
   
       port 9200
   
       logstash_format true
   
       logstash_prefix fluentd
   
       logstash_dateformat %Y%m%d
   
       include_tag_key true
   
       type_name access_log
   
       tag_key @log_name
   
       flush_interval 1s
   
     </store>
   
     <store>
   
       @type stdout
   
     </store>
   
   </match>

3. docker-compose up -d 启动即可  然后配置 docker/swarm daemon.json内容 修改

   "log-driver":"fluentd",
   
   "log-opts":{
   
    "fluentd-address":"192.168.0.133:24224"
   
   },

   注意，此时如果fluentd服务挂了 服务启动不起来的，可以在服务启动时候 加上 --log-opt=fluentd-async-connect

4. 具体详情请参照官方文档  //bbsmax.ikafan.com/static/L3Byb3h5L2h0dHBzL2RvY3MuZmx1ZW50ZC5vcmcvdjAuMTIvYXJ0aWNsZXMvZG9ja2VyLWxvZ2dpbmctZWZrLWNvbXBvc2U=.jpg