搭建elk环境并接入frostmourne，实现监控报警效果（五）

lisanmengmeng2026-08-24 18:34

#修改权限目录,id 1000的账号

chown -R meng.meng data*

chmod -R 777 data*

#docker-compose.yaml

复制代码

version: '3.8'
services:
  filebeat:
    # 镜像名称
    image: docker.elastic.co/beats/filebeat:8.6.0
    # 容器名称
    hostname: filebeat
    container_name: filebeat
    #ports:
    #  - 5044:5044
    volumes:
      - /data/elk_monitor/filebeat:/usr/share/filebeat
#      - /var/log/messages:/var/log/messages
      - /data/logs:/data/logs
    networks:
      - meta 
    deploy:
      replicas: 1
networks:
  meta:
    external: true # 用已经创建好的网络

#启动

docker-compose up -d

#测试

复制代码

setup.kibana:
  host: "192.168.10.14:5601"

output.elasticsearch.allow_older_versions: true
filebeat.inputs:
- input_type: log
  paths:
    - /data/logs/t1.log
  json.keys_under_root: true
  json.overwrite_keys: true
  fields:
    index: 't1_history'

- input_type: log
  paths:
    - /data/logs/t2.log
  json.keys_under_root: true
  json.overwrite_keys: true
  fields:
    index: 't2_history'

output.elasticsearch:
  hosts: ["192.168.10.14:9200"]
  username: "elastic"
  password: "vsUZGKNvjWRtTKPmDG"110120  
  indices:
    - index: "t1_history"
      when.contains:
        fields:
          index: "t1_history"
    - index: "t2_history"
      when.contains:
        fields:
          index: "t2_history"