elasticsearch 配置elasticsearch输出时，Logstash似乎没有启动

我在下面放了一个docker-compose.yml文件。 实际上，我需要的是使用http输入插件提供csv文件，这就是为什么它出现在配置中

version: '3.3'
services:
  logstash:
    image: docker.elastic.co/logstash/logstash:6.7.0
    command: bash -c 'bin/logstash-plugin install logstash-input-http && bin/logstash-plugin install logstash-output-elasticsearch && bin/logstash -e "input { http { port => 5044 } } filter { split {} csv {} } output { elasticsearch { hosts => '127.0.0.1:9200' } }"'
    links:
      - elasticsearch
    ports:
      - 5044:5044
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.7.0
    environment:
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    ports:
      - "9200:9200"
  kibana:
    image: docker.elastic.co/kibana/kibana:6.7.0
    ports:
      - "5601:5601"

configs:
  logstash_config:
    file: ./configs/logstash.conf

volumes:
  esdata1:
    driver: local

我用这个简单的卷曲线进行测试，只是为了测试基本功能是否正常，然后继续使用csv文件和其他配置

version: '3.3'
services:
  logstash:
    image: docker.elastic.co/logstash/logstash:6.7.0
    command: bash -c 'bin/logstash-plugin install logstash-input-http && bin/logstash-plugin install logstash-output-elasticsearch && bin/logstash -e "input { http { port => 5044 } } filter { split {} csv {} } output { elasticsearch { hosts => '127.0.0.1:9200' } }"'
    links:
      - elasticsearch
    ports:
      - 5044:5044
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.7.0
    environment:
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    ports:
      - "9200:9200"
  kibana:
    image: docker.elastic.co/kibana/kibana:6.7.0
    ports:
      - "5601:5601"

configs:
  logstash_config:
    file: ./configs/logstash.conf

volumes:
  esdata1:
    driver: local

当我尝试下面的命令时，它会失败，如图所示：（Windows 10）

但如果在我使用此docker_compose.yml文件时起作用：

version: '3.3'
services:
  logstash:
    image: docker.elastic.co/logstash/logstash:6.7.0
    command: bash -c 'bin/logstash -e "input { http { port => 5044 } } filter { split {} csv {} } output { stdout { codec => rubydebug} }" && bin/logstash-plugin install logstash-input-http && bin/logstash-plugin install logstash-output-elasticsearch'
    links:
      - elasticsearch
    ports:
      - 5044:5044
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.7.0
    environment:
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    ports:
      - "9200:9200"
  kibana:
    image: docker.elastic.co/kibana/kibana:6.7.0
    ports:
      - "5601:5601"

configs:
  logstash_config:
    file: ./configs/logstash.conf

volumes:
  esdata1:
    driver: local

我启动了相同的命令，现在它工作了

 curl 'http://127.0.0.1:5044/twitter/tweet/2' -Method Put -Body 'hello2'


StatusCode        : 200
StatusDescription : OK
Content           : ok
RawContent        : HTTP/1.1 200 OK
                    Content-Length: 2
                    Content-Type: text/plain

                    ok
Forms             : {}
Headers           : {[Content-Length, 2], [Content-Type, text/plain]}
Images            : {}
InputFields       : {}
Links             : {}
ParsedHtml        : mshtml.HTMLDocumentClass
RawContentLength  : 2

我迫切需要将数据传递给elastic 任何关于问题的想法都是受欢迎的

---

提前感谢。

首先，您不必安装logstash插件。包括电池。可以列出插件：

bin/logstash插件列表

接下来，使用docker服务发现。您的服务

elasticsearch

可以从您的日志存储容器中解析。容器中的Localhost解析为-container Localhost，而不是host Localhost

正在工作的docker-compose.yml

version: '3.3'
services:
  logstash:
    image: docker.elastic.co/logstash/logstash:6.7.0
    command: bash -c 'bin/logstash -e "input { http { port => 5044 } } filter { split {} csv {} } output { elasticsearch { hosts => [\"elasticsearch:9200\"] } }"'
    networks:
      - elastic-net
    ports:
      - 5044:5044

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.7.0
    environment:
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    networks:
      - elastic-net
    ports:
      - "9200:9200"
  kibana:
    image: docker.elastic.co/kibana/kibana:6.7.0
    networks:
      - elastic-net
    ports:
      - "5601:5601"

networks:
  elastic-net:

configs:
  logstash_config:
    file: ./configs/logstash.conf

volumes:
  esdata1:
    driver: local

链接是docker遗留构造。而是使用网络结构

祝你好运

version: '3.3'
services:
  logstash:
    image: docker.elastic.co/logstash/logstash:6.7.0
    command: bash -c 'bin/logstash -e "input { http { port => 5044 } } filter { split {} csv {} } output { elasticsearch { hosts => [\"elasticsearch:9200\"] } }"'
    networks:
      - elastic-net
    ports:
      - 5044:5044

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.7.0
    environment:
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    networks:
      - elastic-net
    ports:
      - "9200:9200"
  kibana:
    image: docker.elastic.co/kibana/kibana:6.7.0
    networks:
      - elastic-net
    ports:
      - "5601:5601"

networks:
  elastic-net:

configs:
  logstash_config:
    file: ./configs/logstash.conf

volumes:
  esdata1:
    driver: local