日志输出写入：连接被拒绝答案

【问题标题】：logspout write: connection refused日志输出写入：连接被拒绝
【发布时间】：2017-03-31 16:13:17
【问题描述】：

我遇到了一个错误问题

# logspout v3.2-dev-custom by gliderlabs
# adapters: raw tcp logstash udp syslog
# options : persist:/mnt/routes
# jobs    : http[]:80 pump routes
# routes  :
#   ADAPTER     ADDRESS         CONTAINERS      SOURCES OPTIONS
#   logstash    0.0.0.0:5000                            map[]
2016/11/17 07:15:57 logstash: could not write:write udp 127.0.0.1:34146->127.0.0.1:5000: write: connection refused

在我启动适配器后 sudo docker run --name="logspout" --volume=/var/run/docker.sock:/var/run/docker.sock -e ROUTE_URIS=logstash://0.0.0.0:5000 c045f1a3472b

logstash 5.0 docker 容器正在运行日志

Sending Logstash's logs to /var/log/logstash which is now configured via      log4j2.properties
07:04:11.987 [[main]-pipeline-manager] INFO  logstash.inputs.tcp -         Automatically switching from json to json_lines codec {:plugin=>"tcp"}
07:04:11.987 [[main]<udp] INFO  logstash.inputs.udp - Starting UDP listener {:address=>"0.0.0.0:5000"}
07:04:12.003 [[main]-pipeline-manager] INFO  logstash.inputs.tcp - Starting tcp input listener {:address=>"0.0.0.0:5000"}
07:04:12.409 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>  ["https://~hidden~:~hidden~@fc4fba7c82d6102f5c1a224f0e9f2e9a.us-east-1.aws.found.io:9243"]}}
07:04:12.410 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Using mapping template from {:path=>nil}
07:04:13.612 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Attempting to install template {:manage_template=>{"template"=>"logstash-*",  "version"=>50001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"_default_"=>{"_all"=>{"enabled"=>true, "norms"=>false}, "dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword"}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "include_in_all"=>false}, "@version"=>{"type"=>"keyword", "include_in_all"=>false}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
07:04:13.705 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["fc4fba7c82d6102f5c1a224f0e9f2e9a.us-east-1.aws.found.io:9243"]}
07:04:13.710 [[main]-pipeline-manager] INFO  logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>125}
07:04:13.717 [[main]-pipeline-manager] INFO  logstash.pipeline - Pipeline main started
07:04:13.802 [Api Webserver] INFO  logstash.agent - Successfully started     Logstash API endpoint {:port=>9600}

我正在尝试使用 logspout 和 logstash 将我的个人 docker 容器日志发送到弹性云，其中 logstash、nginx、web 等位于 ec2 实例上。感谢您的帮助。

【问题讨论】：

当我猜测 logstash 和 logspout 位于不同的容器中时，您似乎正在尝试写入 localhost。你能分享更多关于你的设置吗？撰写？联网？每个容器是如何运行的？
嘿@johnharris85 ！感谢您为我指明正确的方向。是的，错误是把它写在主机上，而不是在logstash容器上。使用传统链接 2 个容器解决了问题。刚刚用这两个容器创建了一个 docker-compose.yml 并解决了这个问题。再次感谢。

标签： logging elasticsearch docker logstash devops

【解决方案1】：

在单独的容器中运行 logstash 和 logspout 时，我遇到了同样的问题。就我而言，logspout 试图在 logstash 准备好之前写入 logstash，这导致 logspout 容器出错然后崩溃。它是通过将 RETRY_SEND 环境变量添加到 docker-compose 文件中的 logspout 服务来解决的。

【讨论】：