下载镜像 ``` docker pull logstash:6.8.6 docker tag d0a2dac51fcb harbor.od.com/infra/logstash:v6.8.6 docker push harbor.zq.com/infra/logstash:v6.8.6 ``` 准备目录 mkdir /etc/logstash/ 创建test.conf ``` cat >/etc/logstash/logstash-test.conf <<'EOF' input { kafka { bootstrap_servers => "10.4.7.11:9092" client_id => "10.4.7.200" consumer_threads => 4 group_id => "k8s_test" # 为test组 topics_pattern => "k8s-fb-test-.*" # 只收集k8s-fb-test开头的topics } } filter { json { source => "message" } } output { elasticsearch { hosts => ["10.4.7.12:9200"] index => "k8s-test-%{+YYYY.MM.DD}" } } EOF ``` 创建prod.conf ``` cat >/etc/logstash/logstash-prod.conf <<'EOF' input { kafka { bootstrap_servers => "10.4.7.11:9092" client_id => "10.4.7.200" consumer_threads => 4 group_id => "k8s_prod" topics_pattern => "k8s-fb-prod-.*" } } filter { json { source => "message" } } output { elasticsearch { hosts => ["10.4.7.12:9200"] index => “k8s-prod-%{+YYYY.MM.DD}" } } EOF ``` 启动测试环境的logstash ``` docker run -d \ --restart=always \ --name logstash-test \ -v /etc/logstash:/etc/logstash \ -f /etc/logstash/logstash-test.conf \ harbor.od.com/infra/logstash:v6.8.6 ``` 启动正式环境的logstash ``` docker run -d \ --restart=always \ --name logstash-prod \ -v /etc/logstash:/etc/logstash \ -f /etc/logstash/logstash-prod.conf \ harbor.od.com/infra/logstash:v6.8.6 ``` 查看es是否接收数据 ``` [root@hdss7-12 ~]# curl http://10.4.7.12:9200/_cat/indices?v health status index uuid pri rep docs.count docs.deleted store.size pri.store.size green open k8s-test-2021.01.05 27bgthuSTzSZGVzJW_5Fag 5 0 10 0 64.8kb 64.8kb ```