Docker

Question

所以我正在使用 docker-compose 来启动 ELK 堆栈，它将由 filebeats 填充...我的配置是这样的：

elasticsearch:
  image: elasticsearch:latest
  command: elasticsearch -Des.network.host=_non_loopback_
  ports:
    - "9200:9200"
    - "9300:9300"
logstash:
  image: logstash:latest
  command: logstash -f /etc/logstash/conf.d/logstash.conf -b 10000 -w 1
  volumes:
    - ./logstash/config:/etc/logstash/conf.d
  ports:
    - "5044:5044"
  links:
    - elasticsearch
  environment:
    - LS_HEAP_SIZE=2048m
kibana:
  build: kibana/
  volumes:
    - ./kibana/config/:/opt/kibana/config/
  ports:
    - "5601:5601"
  links:
    - elasticsearch

我的 logstash.conf 文件看起来像这样：

input {
    beats {
      port => 5044
    }
}

....

output {
  elasticsearch {
      hosts => "localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
      document_type => "%{[@metadata][type]}"
    }
  }

这些 docker 个容器在同一个实例上运行，我已确认能够从外部访问两个端口。

从 filebeat 同步文件期间出现的错误是：

logstash_1       | {:timestamp=>"2016-05-19T19:52:55.167000+0000", :message=>"Attempted to send a bulk request to Elasticsearch configured at '[\"http://localhost:9200/\"]', but Elasticsearch appears to be unreachable or down!", :error_message=>"Connection refused", :class=>"Manticore::SocketException", :client_config=>{:hosts=>["http://localhost:9200/"], :ssl=>nil, :transport_options=>{:socket_timeout=>0, :request_timeout=>0, :proxy=>nil, :ssl=>{}}, :transport_class=>Elasticsearch::Transport::Transport::HTTP::Manticore, :logger=>nil, :tracer=>nil, :reload_connections=>false, :retry_on_failure=>false, :reload_on_failure=>false, :randomize_hosts=>false, :http=>{:scheme=>"http", :user=>nil, :password=>nil, :port=>9200}}, :level=>:error}

谢谢，

Answer 1

您尝试访问 localhost 上的 elasticsearch，但这是不可能的，在这种情况下，localhost 是 docker 包含 logstash 的容器。

您必须通过 link 访问它：

output {
 elasticsearch {
  hosts => "elasticsearch:9200"
  manage_template => false
  index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
  document_type => "%{[@metadata][type]}"
 }
}

或者，如果您想从 "outside" 而不是本地主机访问您的 elasticsearch 实例，请填写您的 ip（不是 127.0.0.1）

Docker - ELK 栈 -- "Elasticsearch appears to be uneachable or down"

Docker - ELK stack -- "Elasticsearch appears to be uneachable or down"

elasticsearch

elasticsearch-plugin

docker-compose