利用EFK对日志进行采集_efk采集日志

首先先安装EFK

docker-compose.yml

version: '3'
#如果已经安装过elasticsearch可将elasticsearch下配置全部删除
services:
  elasticsearch:
    image: elasticsearch:7.14.0
    ports:
      - "9200:9200"
    environment:
      - discovery.type=single-node
      - ES_JAVA_OPTS=-Xmx256m -Xms256m

  kibana:
    image: kibana:7.14.0
    ports:
      - "5601:5601"
    depends_on:
      - elasticsearch
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - I18N_LOCALE="zh-CN"

  filebeat:
    image:  elastic/filebeat:7.14.0
    volumes:
      - ./filebeat.yml:/usr/share/filebeat/filebeat.yml
      #日志挂载位置
      - /opt/logs:/usr/share/filebeat/logs
    depends_on:
      - elasticsearch
    command: ["-e"]
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

filebeat.inputs:
- type: log
  paths:
    - /usr/share/filebeat/logs/*.log

output.elasticsearch:
  hosts: ["your IP:9200"]
1
2
3
4
5
6
7

配置完成后在文件所在目录下执行

docker-compose up -d
1

然后配置我们的项目日志配置

配置完成后将项目打包进行发布，可以先测试一下查看你的logs里时候生成了日志，或者查看日志是否正确，然后访问
your Ip:5601 界面
![(https://img-blog.csdnimg.cn/direct/86f93770bb8a4c47950a776e5f00fa71.png)