为什么 docker filebeat 以代码 0 退出？

Question

我在 github 和运行中使用 docker-elk docker-elk container.my 日志显示在 kibana 中。现在我想在 docker-elk.for 中使用 file beat 而不是 logstash-forwarder 我在 github 中选择了 elastic/beats 并构建了一个 docker image.Now 这包含在我的 docker-compose.yml.now 当 iam 运行容器 logstash 运行，elastic search 运行但文件 beat 退出时代码为 0.

这是我的docker-compose.yml

elasticsearch:
  image: elasticsearch:latest
  command: elasticsearch -Des.network.host=0.0.0.0
  ports:
    - "9200:9200"
logstash:
  image: logstash:2.0
  command: logstash agent --config /etc/logstash/conf.d/ -l /var/log/logstash/logstash.log --debug
  volumes:
    - ./logstash/config:/etc/logstash/conf.d
    - ./logstash/patterns/nginx:/etc/logstash/patterns/nginx

  ports:
    - "5000:5000"
  links:
    - elasticsearch
kibana:
  build: kibana/
  volumes:
    - ./kibana/config/kibana.yml:/opt/kibana/config/kibana.yml
  ports:
    - "5601:5601"
  links:
    - elasticsearch
beats:
  image: pavankuamr/beats

  volumes:
   - ./logstash/beats:/etc/filebeat
   - /var/log/nginx:/var/log/nginx
  links:
   - logstash
   - elasticsearch
  environment:
   - ES_HOST=elasticsearch
   - LS_HOST=logstash
   - LS_TCP_PORT=5044

这是我的filebeat.yml

filebeat:

  prospectors:

      paths:
        - /var/log/nginx/access.log



      input_type: log


   registry_file: /var/lib/filebeat/registry


   config_dir: /etc/filebeat/conf.d



  elasticsearch:
    enabled: false

    hosts: ["localhost:9200"]




   logstash:
    # The Logstash hosts
    enabled: true
    hosts: ["localhost:5044"]

这是我的logstash.conf

input {
  beats {
   port => 5044
   type => "logs"
  }
  file {
    type => "nginx"
    start_position => "beginning"
    path => [ "/var/log/nginx/access.log" ]
  }
 file {
    type => "nginxerror"
    start_position => "beginning"
    path => [ "/var/log/nginx/error.log" ]
  }
}
filter {

  if [type] == "nginx" {
    grok {
    patterns_dir => "/etc/logstash/patterns"
    match => { "message" => "%{NGINX_ACCESS}" }
    remove_tag => ["_grokparsefailure"]
    add_tag => ["nginx_access"]
    }

    geoip {
      source => "remote_addr"
    }
  }

  if [type] == "nginxerror" {
    grok {
    patterns_dir => "/etc/logstash/patterns"
    match => { "message" => "%{NGINX_ERROR}" }
    remove_tag => ["_grokparsefailure"]
    add_tag => ["nginx_error"]
    }

  }
}


output {
    elasticsearch {

        hosts => "elasticsearch:9200"
                sniffing => true
                manage_template => false
                index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
                document_type => "%{[@metadata][type]}"
    }

}

Answer 1

将 hosts: ["logstash:9200"] 的 hosts: ["localhost:9200"] 更改为 filebeat.yml

上的 logstash 输出

为什么 docker filebeat 以代码 0 退出？

Why docker filebeat exited with code 0?

logstash-forwarder

dockerfile

docker-compose