Dockerfile
FROM docker.elastic.co/logstash/logstash:7.6.2
COPY ./docker/logstash/logstash.yml /usr/share/logstash/config/logstash.yml
COPY ./docker/logstash/pipeline.conf /usr/share/logstash/pipeline/logstash.conf
EXPOSE 5044
logsta sh .yml
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.hosts: [ "xxx:9200"]
pipeline.id: ID
pipeline.workers: 1
pipeline.batch.size: 1
path.config: "/usr/share/logstash/pipeline/logstash.conf"
pipe.conf
input {
beats {
port => 5044
host => "0.0.0.0"
}
}
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{DATA:environment}\.%{LOGLEVEL:severity}: %{GREEDYDATA:message}" }
}
}
output {
elasticsearch {
hosts => ["xxx:9200"]
index => "access-logs-%{+YYYY.MM.dd}"
}
}
После запуска контейнера я получаю следующее сообщение и затем он просто останавливается:
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/usr/share/logstash/logstash-core/lib/jars/jruby-complete-9.2.9.0.jar) to method sun.nio.ch.NativeThread.signal(long)
WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
Как заставить Logsta sh прослушивать входящие сообщения?