ProHoster > Ibhulogi > Ulawulo > Ukusetyenziswa okusebenzayo kwe-ELK. Ukuseta logstash

Ukusetyenziswa okusebenzayo kwe-ELK. Ukuseta logstash

Intshayelelo

Ngelixa sihambisa enye inkqubo, besijongene nesidingo sokujonga inani elikhulu leelogi ezahlukeneyo. I-ELK yakhethwa njengesixhobo. Eli nqaku liza kuxoxa ngamava ethu ekusekweni kwesi sitaki.

Asizibekeli usukelo lokuchaza zonke izakhono zayo, kodwa sifuna ukugxila ngakumbi ekusombululeni iingxaki ezisebenzayo. Oku kungenxa yokuba nangona kukho inani elikhulu lamaxwebhu kunye nemifanekiso esele yenziwe, mininzi imigibe, ubuncinci siyifumene.

Sisasaze istaki nge-docker-compose. Ngaphezu koko, sasine-docker-compose.yml ebhalwe kakuhle, eyasivumela ukuba siphakamise isitaki phantse ngaphandle kweengxaki. Kwaye kwakubonakala ngathi uloyiso sele lusondele, ngoku siza kuyilungisa kancinci ukuze ihambelane neemfuno zethu kwaye yiyo loo nto.

Ngelishwa, iinzame zokumisela inkqubo yokwamkela nokuqhuba iilog kwisicelo sethu azizange zibe yimpumelelo ngoko nangoko. Ngoko ke, siye sagqiba ukuba kubalulekile ukufundisisa icandelo ngalinye ngokwahlukeneyo, kwaye emva koko sibuyele kunxibelelwano lwabo.

Ke, siqale ngelogstash.

Okusingqongileyo, ukusasazwa, ukuqhuba iLogstash kwisikhongozeli

Ukusasaza sisebenzisa i-docker-compose; imifuniselo echazwe apha yenziwa kwi-MacOS kunye no-Ubuntu 18.0.4.

Umfanekiso welogstash obhaliswe kwidocker-compose.yml yethu yoqobo ngu docker.elastic.co/logstash/logstash:6.3.2

Siza kuyisebenzisela imifuniselo.

Sibhale i-docker-compose.yml eyahlukileyo ukuqhuba i-logstash. Ewe, kwakunokwenzeka ukuqalisa umfanekiso ukusuka kumgca womyalelo, kodwa sasixazulula ingxaki ethile, apho yonke into yaqaliswa ukusuka kwi-docker-compose.

Ngokufutshane malunga neefayile zoqwalaselo

Ngokulandelayo ukusuka kwinkcazo, ilogstash ingaqhutywa nokuba yeyomnye umjelo, apho idinga ukudlula ifayile *.conf, okanye amajelo amaninzi, apho kufuneka idlulise i pipelines.yml ifayile, leyo, ngokulandelelana kwayo. , iya kudibanisa kwiifayile .conf kwitshaneli nganye.
Sathatha indlela yesibini. Kuthi kwakubonakala ngathi yinto yehlabathi jikelele kwaye ikhula. Ngoko ke, senze i-pipelines.yml, kwaye senza uluhlu lwemibhobho apho siya kubeka iifayile ze-.conf kwitshaneli nganye.

Ngaphakathi kwesikhongozeli kukho enye ifayile yoqwalaselo - logstash.yml. Asiyichukumisi, siyisebenzisa njengoko injalo.

Ke, ubume bethu bolawulo:

Ukusetyenziswa okusebenzayo kwe-ELK. Ukuseta logstash

Ukufumana idatha yegalelo, okwangoku sicinga ukuba le yi-tcp kwi-port 5046, kwaye kwimveliso siya kusebenzisa i-stdout.

Nalu uqwalaselo olulula lophehlelelo lokuqala. Ngenxa yokuba umsebenzi wokuqala kukuqalisa.

Ke, sinale docker-compose.yml

version: '3'

networks:
  elk:

volumes:
  elasticsearch:
    driver: local

services:

  logstash:
    container_name: logstash_one_channel
    image: docker.elastic.co/logstash/logstash:6.3.2
    networks:
      	- elk
    ports:
      	- 5046:5046
    volumes:
      	- ./config/pipelines.yml:/usr/share/logstash/config/pipelines.yml:ro
	- ./config/pipelines:/usr/share/logstash/config/pipelines:ro

Sibona ntoni apha?

  1. Uthungelwano kunye nemiqulu yathathwa kwi-docker-compose.yml yoqobo (enye apho isitaki siphela) kwaye ndicinga ukuba azichaphazeli kakhulu umfanekiso olapha.
  2. Senza inkonzo enye yelogstash ukusuka kwi-docker.elastic.co/logstash/logstash:6.3.2 umfanekiso kwaye uyinike igama elithi logstash_one_channel.
  3. Sithumela izibuko 5046 ngaphakathi kwesikhongozeli, kwizibuko elifanayo langaphakathi.
  4. Sifaka imephu yethu ifayile yokumisela umbhobho ./config/pipelines.yml kwifayile /usr/share/logstash/config/pipelines.yml ngaphakathi kwesitya, apho i-logstash iya kuyithabatha kwaye iyenze ifundeke kuphela, xa kunjalo.
  5. Senza imephu ./config/pipelines directory, apho sineefayile ezinesetingi zetshaneli, kwi/usr/share/logstash/config/pipelines directory kwaye siyenze ifundeke kuphela.

Ukusetyenziswa okusebenzayo kwe-ELK. Ukuseta logstash

Pipelines.yml ifayile

- pipeline.id: HABR
  pipeline.workers: 1
  pipeline.batch.size: 1
  path.config: "./config/pipelines/habr_pipeline.conf"

Itshaneli enye ene-HABR isazisi kunye nendlela eya kwifayile yayo yoqwalaselo ichazwe apha.

Kwaye ekugqibeleni ifayile "./config/pipelines/habr_pipeline.conf"

input {
  tcp {
    port => "5046"
   }
  }
filter {
  mutate {
    add_field => [ "habra_field", "Hello Habr" ]
    }
  }
output {
  stdout {
      
    }
  }

Masingangeni kwinkcazo yayo okwangoku, makhe sizame ukuyiqhuba:

docker-compose up

Sibona ntoni?

Isikhongozeli siqalile. Singajonga ukusebenza kwayo:

echo '13123123123123123123123213123213' | nc localhost 5046

Kwaye sibona impendulo kwiconsole yecontainer:

Ukusetyenziswa okusebenzayo kwe-ELK. Ukuseta logstash

Kodwa kwangaxeshanye, sibona kwakhona:

logstash_one_channel | [2019-04-29T11:28:59,790][ERROR][logstash.licensechecker.licensereader] Ayikwazanga kuphinda ifumane ulwazi lwelayisenisi kwiseva yelayisensi {:message=>“Elasticsearch Unreachable: [http://elasticsearch:9200/][Manticore ::ResolutionFailure] elasticsearch", ...

logstash_one_channel | [2019-04-29T11:28:59,894][INFO ][logstash.pipeline ] Umbhobho uqale ngempumelelo {:pipeline_id=>".monitoring-logstash", :thread=>"#"}

logstash_one_channel | [2019-04-29T11:28:59,988][INFO ][logstash.agent ] Imibhobho esebenzayo {:count=>2, :running_pipelines=>[:HABR, :".monitoring-logstash"], :non_running_pipelines=>[ ]}
logstash_one_channel | [2019-04-29T11:29:00,015][ERROR][logstash.inputs.metrics] I-X-Pack ifakwe kwiLogstash kodwa hayi kwi-Elasticsearch. Nceda ufake i-X-Pack kwi-Elasticsearch ukuze usebenzise uphawu lokuhlola. Ezinye iimpawu zinokufumaneka.
logstash_one_channel | [2019-04-29T11:29:00,526][INFO ][logstash.agent ] Iqaliswe ngempumelelo iLogstash API endpoint {:port=>9600}
logstash_one_channel | [2019-04-29T11:29:04,478][INFO ][logstash.outputs.elasticsearch] Ukuqhuba ukujonga impilo ukubona ukuba uqhagamshelo lwe-Elasticsearch luyasebenza na {:healthcheck_url=>http://elasticsearch:9200/, :path=> "/"}
logstash_one_channel | [2019-04-29T11:29:04,487][LUMKISA] [logstash.outputs.elasticsearch] Uzame ukuvusa unxibelelwano kumzekelo we-ES ofileyo, kodwa wafumana impazamo. {:url=>“elasticsearch:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://elasticsearch:9200/][Manticoreil::Reso] elasticsearch"}
logstash_one_channel | [2019-04-29T11:29:04,704][INFO ][logstash.licensechecker.licensereader] Ukuqhuba ukujonga impilo ukubona ukuba uqhagamshelo lwe-Elasticsearch luyasebenza na {:healthcheck_url=>http://elasticsearch:9200/, :path=> "/"}
logstash_one_channel | [2019-04-29T11:29:04,710][LUMKISA ][logstash.licensechecker.licensereader] Uzame ukuvusa uqhagamshelo kumzekelo we-ES ofileyo, kodwa wafumana impazamo. {:url=>“elasticsearch:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://elasticsearch:9200/][Manticoreil::Reso] elasticsearch"}

Kwaye i-log yethu iyanyuka ngalo lonke ixesha.

Apha ndiphawule ngokuluhlaza umyalezo oqaliswe ngumbhobho ngempumelelo, ngobomvu umyalezo wemposiso kwaye kumthubi umyalezo malunga nokuzama ukuqhagamshelana. elasticsearch: 9200.
Oku kwenzeka ngenxa yokuba i-logstash.conf, efakwe kumfanekiso, iqulethe itshekhi yokufumaneka kwe-elasticsearch. Emva kwayo yonke loo nto, i-logstash ithatha ukuba isebenza njengenxalenye yesitaki se-Elk, kodwa sayahlula.

Kuyenzeka ukuba usebenze, kodwa akulunganga.

Isisombululo kukuvala olu qwalaselo usebenzisa i-XPACK_MONITORING_ENABLED imo eguquguqukayo.

Masenze utshintsho kwi-docker-compose.yml kwaye siyiqhube kwakhona:

version: '3'

networks:
  elk:

volumes:
  elasticsearch:
    driver: local

services:

  logstash:
    container_name: logstash_one_channel
    image: docker.elastic.co/logstash/logstash:6.3.2
    networks:
      - elk
    environment:
      XPACK_MONITORING_ENABLED: "false"
    ports:
      - 5046:5046
   volumes:
      - ./config/pipelines.yml:/usr/share/logstash/config/pipelines.yml:ro
      - ./config/pipelines:/usr/share/logstash/config/pipelines:ro

Ngoku, yonke into ilungile. Isikhongozeli sikulungele ukuvavanywa.

Singachwetheza kwakhona kwikhonsoli elandelayo:

echo '13123123123123123123123213123213' | nc localhost 5046

Kwaye bona:

logstash_one_channel | {
logstash_one_channel |         "message" => "13123123123123123123123213123213",
logstash_one_channel |      "@timestamp" => 2019-04-29T11:43:44.582Z,
logstash_one_channel |        "@version" => "1",
logstash_one_channel |     "habra_field" => "Hello Habr",
logstash_one_channel |            "host" => "gateway",
logstash_one_channel |            "port" => 49418
logstash_one_channel | }

Ukusebenza kwitshaneli enye

Ngoko siye saqalisa. Ngoku unokuthatha ixesha lokuqwalasela ilogstash ngokwayo. Masingachukumisi ifayile ye pipelines.yml okwangoku, makhe sibone ukuba yintoni esinokuyifumana ngokusebenza ngetshaneli enye.

Ndimele nditsho ukuba umgaqo oqhelekileyo wokusebenza kunye nefayile yoqwalaselo lwetshaneli ichazwe kakuhle kwincwadana esemthethweni, apha apha
Ukuba ufuna ukufunda ngesiRashiya, sisebenzise le inqaku(kodwa i-syntax yombuzo ikhona indala, kufuneka siyithathele ingqalelo le nto).

Masihambe ngokulandelelanayo ukusuka kwicandelo lokuNgena. Sele siwubonile umsebenzi kwi-TCP. Yintoni enye enokuba nomdla apha?

Uvavanyo lwemiyalezo usebenzisa ukubetha kwentliziyo

Kukho ithuba elinomdla lokuvelisa imiyalezo yovavanyo oluzenzekelayo.
Ukwenza oku, kufuneka uvule iplagin ye-heartbean kwicandelo lokufaka.

input {
  heartbeat {
    message => "HeartBeat!"
   }
  }

Yivule, qala ukufumana kube kanye ngomzuzu 

logstash_one_channel | {
logstash_one_channel |      "@timestamp" => 2019-04-29T13:52:04.567Z,
logstash_one_channel |     "habra_field" => "Hello Habr",
logstash_one_channel |         "message" => "HeartBeat!",
logstash_one_channel |        "@version" => "1",
logstash_one_channel |            "host" => "a0667e5c57ec"
logstash_one_channel | }

Ukuba sifuna ukufumana rhoqo, kufuneka songeze iparameter yesithuba.
Le yindlela esiya kufumana ngayo umyalezo rhoqo ngemizuzwana eyi-10.

input {
  heartbeat {
    message => "HeartBeat!"
    interval => 10
   }
  }

Ukufumana idatha kwifayile

Siphinde sagqiba ekubeni sijonge imo yefayile. Ukuba isebenza kakuhle ngefayile, mhlawumbi akukho arhente ifunekayo, ubuncinci kusetyenziso lwasekhaya.

Ngokutsho kwenkcazo, imodi yokusebenza kufuneka ifane nomsila -f, i.e. ifunda iilayini ezintsha okanye, njengokhetho, ifunda yonke ifayile.

Ngoko sifuna ukufumana:

  1. Sifuna ukufumana iilayini ezihlonyelwe kwifayile yelog enye.
  2. Sifuna ukufumana idatha ebhaliweyo kwiifayile ezininzi zelog, ngelixa sikwazi ukwahlula oko kufunyenweyo ukusuka phi.
  3. Sifuna ukuqiniseka ukuba xa ilogstash iqalwa ngokutsha, ayifumani le datha kwakhona.
  4. Sifuna ukujonga ukuba i-logstash ivaliwe, kwaye idatha iyaqhubeka ibhalwa kwiifayile, ngoko xa siqhuba, siya kufumana le datha.

Ukuqhuba uvavanyo, masenze omnye umgca kwi-docker-compose.yml, sivula i-directory apho sibeka khona iifayile.

version: '3'

networks:
  elk:

volumes:
  elasticsearch:
    driver: local

services:

  logstash:
    container_name: logstash_one_channel
    image: docker.elastic.co/logstash/logstash:6.3.2
    networks:
      - elk
    environment:
      XPACK_MONITORING_ENABLED: "false"
    ports:
      - 5046:5046
   volumes:
      - ./config/pipelines.yml:/usr/share/logstash/config/pipelines.yml:ro
      - ./config/pipelines:/usr/share/logstash/config/pipelines:ro
      - ./logs:/usr/share/logstash/input

Kwaye utshintshe icandelo longeniso kwi habr_pipeline.conf

input {
  file {
    path => "/usr/share/logstash/input/*.log"
   }
  }

Masiqalise:

docker-compose up

Ukwenza kunye nokubhala iifayile zelog siya kusebenzisa umyalelo:


echo '1' >> logs/number1.log


{
logstash_one_channel |            "host" => "ac2d4e3ef70f",
logstash_one_channel |     "habra_field" => "Hello Habr",
logstash_one_channel |      "@timestamp" => 2019-04-29T14:28:53.876Z,
logstash_one_channel |        "@version" => "1",
logstash_one_channel |         "message" => "1",
logstash_one_channel |            "path" => "/usr/share/logstash/input/number1.log"
logstash_one_channel | }

Ewe, iyasebenza!

Kwangaxeshanye, siyabona ukuba songeze ngokuzenzekelayo ibala lendlela. Oku kuthetha ukuba kwixesha elizayo, siya kukwazi ukucoca iirekhodi ngayo.

Masizame kwakhona:

echo '2' >> logs/number1.log


{
logstash_one_channel |            "host" => "ac2d4e3ef70f",
logstash_one_channel |     "habra_field" => "Hello Habr",
logstash_one_channel |      "@timestamp" => 2019-04-29T14:28:59.906Z,
logstash_one_channel |        "@version" => "1",
logstash_one_channel |         "message" => "2",
logstash_one_channel |            "path" => "/usr/share/logstash/input/number1.log"
logstash_one_channel | }

Kwaye ngoku kwenye ifayile:

 echo '1' >> logs/number2.log


{
logstash_one_channel |            "host" => "ac2d4e3ef70f",
logstash_one_channel |     "habra_field" => "Hello Habr",
logstash_one_channel |      "@timestamp" => 2019-04-29T14:29:26.061Z,
logstash_one_channel |        "@version" => "1",
logstash_one_channel |         "message" => "1",
logstash_one_channel |            "path" => "/usr/share/logstash/input/number2.log"
logstash_one_channel | }

Kakhulu! Ifayile yathathwa, umendo uchazwe ngokuchanekileyo, yonke into ilungile.

Misa logstash kwaye uqale kwakhona. Masilinde. Cwaka. Ezo. Asizifumani ezi rekhodi kwakhona.

Kwaye ngoku olona vavanyo lunamandla.

Faka ilogstash kwaye uphumeze:

echo '3' >> logs/number2.log
echo '4' >> logs/number1.log

Qhuba i-logstash kwakhona kwaye ubone:

logstash_one_channel | {
logstash_one_channel |            "host" => "ac2d4e3ef70f",
logstash_one_channel |     "habra_field" => "Hello Habr",
logstash_one_channel |         "message" => "3",
logstash_one_channel |        "@version" => "1",
logstash_one_channel |            "path" => "/usr/share/logstash/input/number2.log",
logstash_one_channel |      "@timestamp" => 2019-04-29T14:48:50.589Z
logstash_one_channel | }
logstash_one_channel | {
logstash_one_channel |            "host" => "ac2d4e3ef70f",
logstash_one_channel |     "habra_field" => "Hello Habr",
logstash_one_channel |         "message" => "4",
logstash_one_channel |        "@version" => "1",
logstash_one_channel |            "path" => "/usr/share/logstash/input/number1.log",
logstash_one_channel |      "@timestamp" => 2019-04-29T14:48:50.856Z
logstash_one_channel | }

Uxolo! Yacholwa yonke into.

Kodwa kufuneka sikulumkise malunga noku kulandelayo. Ukuba isikhongozeli selogstash sicinyiwe (docker stop logstash_one_channel && docker rm logstash_one_channel), akukho nto iya kucholwa. Indawo ekuyo ifayile apho ifundwe khona yayigcinwe ngaphakathi kwisikhongozeli. Ukuba uyiqhuba ukusuka ekuqaleni, iya kwamkela imigca emitsha kuphela.

Ukufunda iifayile ezikhoyo

Masithi sisungula i-logstash okokuqala, kodwa sele sinamalogi kwaye singathanda ukuwaqhuba.
Ukuba siqhuba i-logstash kunye necandelo legalelo esilisebenzisileyo ngasentla, asiyi kufumana nto. Kuphela imigca emitsha iya kuqhutyelwa phambili yi-logstash.

Ukuze imigca esuka kwiifayile ezikhoyo itsalwe phezulu, kufuneka udibanise umgca owongezelelweyo kwicandelo longeniso:

input {
  file {
    start_position => "beginning"
    path => "/usr/share/logstash/input/*.log"
   }
  }

Ngaphezu koko, kukho i-nuance: oku kuchaphazela kuphela iifayile ezintsha ezingekabonwa yi-logstash. Kwiifayile ezifanayo esele zisentsimi yemboniselo yelogstash, sele ikhumbule ubungakanani bazo kwaye ngoku iya kuthatha amangeno amatsha kuzo.

Masime apha sifunde icandelo lokufaka. Kukho iindlela ezininzi onokukhetha kuzo, kodwa oko kwanele kuthi kwimifuniselo eyongezelelweyo okwangoku.

Umzila kunye noTshintsho lweDatha

Masizame ukusombulula le ngxaki ilandelayo, masithi sinemiyalezo esuka kwisitishi esinye, eminye yayo inolwazi, kwaye eminye yimiyalezo yempazamo. Ziyahluka ngokwethegi. Ezinye ZI-INFO, ezinye YI-ERROR.

Kufuneka sibahlule ekuphumeni. Ezo. Sibhala imiyalezo yolwazi kwelinye itshaneli, kunye nemiyalezo yempazamo kwelinye.

Ukwenza oku, suka kwicandelo lokufaka ukucoca kunye nemveliso.

Ukusebenzisa icandelo lokucoca, siya kucazulula umyalezo ongenayo, sifumana i-hash (i-key-value pairs) kuyo, esinokusebenza nayo, oko kukuthi. qhaqha ngokwemiqathango. Kwaye kwicandelo lemveliso, siya kukhetha imiyalezo kwaye sithumele nganye kwisitishi sayo.

Ukudlulisa umyalezo nge-grok

Ukuze uhlalutye imitya yokubhaliweyo kwaye ufumane isethi yamasimi kubo, kukho iplagin ekhethekileyo kwicandelo lokucoca - grok.

Ngaphandle kokuzibekela injongo yokunika inkcazo eneenkcukacha ngayo apha (koku ndibhekisa kuko amaxwebhu asemthethweni), ndiza kunika umzekelo wam olula.

Ukwenza oku, kufuneka wenze isigqibo malunga nefomathi yeentambo zokufaka. Ndinabo ngolu hlobo:

1 ULWAZI lomyalezo1
2 Umyalezo wempazamo2

Ezo. Isichongi siza kuqala, emva koko ULWAZI/ERROR, emva koko elinye igama ngaphandle kwezithuba.
Akunzima, kodwa kwanele ukuqonda umgaqo wokusebenza.

Ke, kwicandelo lokucoca leplagi yegrok, kufuneka sichaze ipateni yokwahlulahlula imitya yethu.

Iya kujongeka ngolu hlobo:

filter {
  grok {
    match => { "message" => ["%{INT:message_id} %{LOGLEVEL:message_type} %{WORD:message_text}"] }
   }
  }

Ngokwenyani yintetho eqhelekileyo. Iipateni esele zenziwe zisetyenziswa, ezifana ne-INT, LOGLEVEL, WORD. Inkcazo yabo, kunye nezinye iipateni, zinokufumaneka apha apha

Ngoku, ukugqitha kwesi sihluzo, umtya wethu uya kujika ube yihashi yemihlaba emithathu: message_id, message_type, message_text.

Ziya kuboniswa kwicandelo lemveliso.

Ukuthumela imiyalezo kwicandelo lemveliso usebenzisa i if umyalelo

Kwicandelo lemveliso, njengoko sikhumbula, sasiza kwahlula imiyalezo ibe yimijelo emibini. Ezinye - eziyi-iNFO, ziya kuphuma kwikhonsoli, kwaye ngeempazamo, siya kukhupha ifayile.

Siyohlula njani le miyalezo? Imeko yengxaki sele icebisa isisombululo - emva kwayo yonke loo nto, sele sinendawo enikezelweyo ye-message_type, enokuthi ithathe amaxabiso amabini kuphela: INFO kunye ne-ERROR. Kukwesi siseko apho siya kwenza ukhetho sisebenzisa i-if statement.

if [message_type] == "ERROR" {
        # Здесь выводим в файл
       } else
     {
      # Здесь выводим в stdout
    }

Inkcazo yokusebenza ngamasimi kunye nabaqhubi inokufumaneka kweli candelo incwadi esemthethweni.

Ngoku, malunga nesigqibo esisiso.

Imveliso yeConsole, yonke into icacile apha - stdout {}

Kodwa isiphumo kwifayile - khumbula ukuba siqhuba konke oku kwisikhongozeli kwaye ukuze ifayile esibhala kuyo isiphumo ifikeleleke ngaphandle, kufuneka sivule olu lawulo kwi-docker-compose.yml.

Iyonke:

Icandelo lemveliso yefayile yethu lijongeka ngolu hlobo:


output {
  if [message_type] == "ERROR" {
    file {
          path => "/usr/share/logstash/output/test.log"
          codec => line { format => "custom format: %{message}"}
         }
    } else
     {stdout {
             }
     }
  }

Kwi-docker-compose.yml songeza enye ivolumu yemveliso:

version: '3'

networks:
  elk:

volumes:
  elasticsearch:
    driver: local

services:

  logstash:
    container_name: logstash_one_channel
    image: docker.elastic.co/logstash/logstash:6.3.2
    networks:
      - elk
    environment:
      XPACK_MONITORING_ENABLED: "false"
    ports:
      - 5046:5046
   volumes:
      - ./config/pipelines.yml:/usr/share/logstash/config/pipelines.yml:ro
      - ./config/pipelines:/usr/share/logstash/config/pipelines:ro
      - ./logs:/usr/share/logstash/input
      - ./output:/usr/share/logstash/output

Siyayisungula, siyizame, kwaye sibone ulwahlulo lube yimijelo emibini.

umthombo: www.habr.com

Yongeza izimvo