#修改权限目录,id 1000的账号chown -R meng.meng data*chmod -R 777 data*#docker-compose.yamlversion: 3.8 services: filebeat: # 镜像名称 image: docker.elastic.co/beats/filebeat:8.6.0 # 容器名称 hostname: filebeat container_name: filebeat #ports: # - 5044:5044 volumes: - /data/elk_monitor/filebeat:/usr/share/filebeat # - /var/log/messages:/var/log/messages - /data/logs:/data/logs networks: - meta deploy: replicas: 1 networks: meta: external: true # 用已经创建好的网络#启动docker-compose up -d#测试setup.kibana: host: 192.168.10.14:5601 output.elasticsearch.allow_older_versions: true filebeat.inputs: - input_type: log paths: - /data/logs/t1.log json.keys_under_root: true json.overwrite_keys: true fields: index: t1_history - input_type: log paths: - /data/logs/t2.log json.keys_under_root: true json.overwrite_keys: true fields: index: t2_history output.elasticsearch: hosts: [192.168.10.14:9200] username: elastic password: vsUZGKNvjWRtTKPmDG110120 indices: - index: t1_history when.contains: fields: index: t1_history - index: t2_history when.contains: fields: index: t2_history