setup - ELK(elasticsearch, logstash, kibana) + filebeat

docker-compose.yml 작성

version: '2'

services:

  logstash:
    container_name: logstash
    image: logstash:6.6.2
    ports:
      - "5000:5000"
      - "5044:5044"
      - "9600:9600"
    restart: unless-stopped
    depends_on:
      - elasticsearch

  elasticsearch:
    container_name: elasticsearch
    image: elasticsearch:6.6.2
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      - node.name=local-ec2-elasticsearch-01
      - discovery.type=single-node
      - cluster.name=luna-lms
    restart: unless-stopped

  kibana:
    container_name: kibana
    image: kibana:6.6.2
    ports:
      - "5601:5601"
    restart: unless-stopped
    mem_limit: "512m"
    depends_on:
      - elasticsearch

docker-compse 실행

docker-compose up -d

bash shell 실행

docker exec -it logstash bash
vi /usr/share/logstash/pipeline/logstash.conf

logstash.conf 파일 작성

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => [ "elasticsearch:9200" ]
    index => "dean-service-log-%{+YYYY.MM}"
  }
  stdout {
    codec => rubydebug
  }
}

filebeat 다운로드

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.6.2-darwin-x86_64.tar.gz
tar -zxvf filebeat-6.6.2-darwin-x86_64.tar.gz
vi /Users/dean/filebeat/filebeat-6.6.2-darwin-x86_64/filebeat.yml

filebeat.yml 파일 수정 (중요한 부분만 추출함)

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /Users/dean/dev/logs/*.log

output.logstash:
  hosts: ["localhost:5044"]

filebeat 실행

./filebeat -e -c ./filebeat.yml

elasticsearch 확인

index 명 : dean-service-log-2020.10