From a4fd0e53c786485b3e40bd2d8c57b111d3c27a4a Mon Sep 17 00:00:00 2001
From: smallchill <smallchill@163.com>
Date: Fri, 1 Nov 2019 20:19:33 +0800
Subject: [PATCH] =?UTF-8?q?:tada:=20=E4=BC=98=E5=8C=96elk=E8=84=9A?=
 =?UTF-8?q?=E6=9C=AC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 script/docker/elk/docker-compose.yml | 7 ++++---
 script/docker/elk/elk-deploy.sh      | 9 +++++----
 script/docker/elk/filebeat.yml       | 5 ++++-
 script/docker/elk/logstash.yml       | 8 ++++++++
 4 files changed, 21 insertions(+), 8 deletions(-)
 create mode 100644 script/docker/elk/logstash.yml

diff --git a/script/docker/elk/docker-compose.yml b/script/docker/elk/docker-compose.yml
index 48abbbee..a738465d 100644
--- a/script/docker/elk/docker-compose.yml
+++ b/script/docker/elk/docker-compose.yml
@@ -83,12 +83,14 @@ services:
     volumes:
       - ./filebeat/conf/filebeat.yml:/usr/share/filebeat/filebeat.yml
       # 映射到容器中[作为数据源]
-      - ./logs:/home/project/spring-boot-elasticsearch/logs
+      - ./logs:/home/project/elk/logs
       - ./filebeat/logs:/usr/share/filebeat/logs
       - ./filebeat/data:/usr/share/filebeat/data
     # 将指定容器连接到当前连接，可以设置别名，避免ip方式导致的容器重启动态改变的无法连接情况
     links:
       - logstash
+    ports:
+      - 9000:9000
     # 依赖服务[可无]
     depends_on:
       - es-master
@@ -104,8 +106,7 @@ services:
     volumes:
       # 映射到容器中
       - ./logstash/conf/logstash-filebeat.conf:/usr/share/logstash/conf/logstash-filebeat.conf
-    environment:
-      - elasticsearch.hosts=http://es-master:9200
+      - ./logstash/conf/logstash.yml:/usr/share/logstash/config/logstash.yml
     ports:
       - 5044:5044
     depends_on:
diff --git a/script/docker/elk/elk-deploy.sh b/script/docker/elk/elk-deploy.sh
index de5786e9..cb003fa3 100644
--- a/script/docker/elk/elk-deploy.sh
+++ b/script/docker/elk/elk-deploy.sh
@@ -65,10 +65,11 @@ if [ -f "./kibana.yml" ]; then
 mv ./kibana.yml ./kibana/conf
 fi
 
- echo -e "${GREEN_COLOR}---> move [logstash]config file start.${RES}"
- if [ -f "./logstash-filebeat.conf" ]; then
- mv ./logstash-filebeat.conf ./logstash/conf
- fi
+echo -e "${GREEN_COLOR}---> move [logstash]config file start.${RES}"
+if [ -f "./logstash.yml" ] && [ -f "./logstash-filebeat.conf" ]; then
+mv ./logstash-filebeat.conf ./logstash/conf
+mv ./logstash.yml ./logstash/conf
+fi
 
 echo -e "${GREEN_COLOR}---> move [filebeat]config file start.${RES}"
 if [ -f "./filebeat.yml" ]; then
diff --git a/script/docker/elk/filebeat.yml b/script/docker/elk/filebeat.yml
index a7d2b37c..b5db11c0 100644
--- a/script/docker/elk/filebeat.yml
+++ b/script/docker/elk/filebeat.yml
@@ -3,10 +3,13 @@ filebeat.inputs:
     enabled: true
     paths:
       # 当前目录下的所有.log文件
-      - /home/project/spring-boot-elasticsearch/logs/*.log
+      - /home/project/elk/logs/*.log
     multiline.pattern: ^\[
     multiline.negate: true
     multiline.match: after
+  - type: tcp
+    max_message_size: 10MiB
+    host: "0.0.0.0:9000"
 
 filebeat.config.modules:
   path: ${path.config}/modules.d/*.yml
diff --git a/script/docker/elk/logstash.yml b/script/docker/elk/logstash.yml
new file mode 100644
index 00000000..87dd3c81
--- /dev/null
+++ b/script/docker/elk/logstash.yml
@@ -0,0 +1,8 @@
+# 服务IP
+http.host: "0.0.0.0"
+# ES
+xpack.monitoring.elasticsearch.hosts: [ "http://es-master:9200", "http://es-slave1:9201", "http://es-slave2:9202" ]
+
+xpack.monitoring.enabled: true
+
+xpack.management.enabled: false