为什么 docker filebeat 以代码 0 退出？

Question

我在 github 中使用 docker-elk 并运行 docker-elk 容器。我的日志显示在 kibana 中。 现在我想在docker-elk中使用文件beat而不是logstash-forwarder。因为我在github中选择了elastic/beats并构建了一个docker镜像。现在这包含在我的docker-compose.yml.now 当 iam 运行容器 logstash 运行时，弹性搜索正在运行，但文件节拍以代码 0 退出。

这是我的 docker-compose.yml

elasticsearch:
  image: elasticsearch:latest
  command: elasticsearch -Des.network.host=0.0.0.0
  ports:
    - "9200:9200"
logstash:
  image: logstash:2.0
  command: logstash agent --config /etc/logstash/conf.d/ -l /var/log/logstash/logstash.log --debug
  volumes:
    - ./logstash/config:/etc/logstash/conf.d
    - ./logstash/patterns/nginx:/etc/logstash/patterns/nginx

  ports:
    - "5000:5000"
  links:
    - elasticsearch
kibana:
  build: kibana/
  volumes:
    - ./kibana/config/kibana.yml:/opt/kibana/config/kibana.yml
  ports:
    - "5601:5601"
  links:
    - elasticsearch
beats:
  image: pavankuamr/beats

  volumes:
   - ./logstash/beats:/etc/filebeat
   - /var/log/nginx:/var/log/nginx
  links:
   - logstash
   - elasticsearch
  environment:
   - ES_HOST=elasticsearch
   - LS_HOST=logstash
   - LS_TCP_PORT=5044

这是我的文件beat.yml

filebeat:

  prospectors:

      paths:
        - /var/log/nginx/access.log



      input_type: log


   registry_file: /var/lib/filebeat/registry


   config_dir: /etc/filebeat/conf.d



  elasticsearch:
    enabled: false

    hosts: ["localhost:9200"]




   logstash:
    # The Logstash hosts
    enabled: true
    hosts: ["localhost:5044"] 

这是我的 logstash.conf

input {
  beats {
   port => 5044
   type => "logs"
  }
  file {
    type => "nginx"
    start_position => "beginning"
    path => [ "/var/log/nginx/access.log" ]
  }
 file {
    type => "nginxerror"
    start_position => "beginning"
    path => [ "/var/log/nginx/error.log" ]
  }
}
filter {

  if [type] == "nginx" {
    grok {
    patterns_dir => "/etc/logstash/patterns"
    match => { "message" => "%{NGINX_ACCESS}" }
    remove_tag => ["_grokparsefailure"]
    add_tag => ["nginx_access"]
    }

    geoip {
      source => "remote_addr"
    }
  }

  if [type] == "nginxerror" {
    grok {
    patterns_dir => "/etc/logstash/patterns"
    match => { "message" => "%{NGINX_ERROR}" }
    remove_tag => ["_grokparsefailure"]
    add_tag => ["nginx_error"]
    }

  }
}


output {
    elasticsearch {

        hosts => "elasticsearch:9200"
                sniffing => true
                manage_template => false
                index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
                document_type => "%{[@metadata][type]}"
    }

}

Answer 1

将hosts: ["localhost:9200"] 的hosts: ["logstash:9200"] 更改为filebeat.yml 上的logstash 输出