Elk Remote Logging Log monitoring

Master Machine Run Command:

Mkdir-p/var/log/-P/var/log/-P/var/log/-v/tmp:/tmp-v/log :/log-v/var/log:/var5601:56019200:92009300 :93005044:5044:--name Elk Sebp/elk

Only the Lagstash is turned on in slave and the related log is directed to the primary elk server:

Mkdir-p/var/log/-v/tmp:/tmp-v/log:/log-v/var/log:/var5601:  56019200:92009300:93005044:50445000 : elasticsearch_start=-e0 -e kibana_start=0 --name Elk sebp/elk

Logstash will error after startup because by default point to the local Elasticsearch service, log in to Docker to change the configuration file:

Docker exec-it elk/bin//etc/logstash/conf.d/-output.conf

= = ["<your-host-name>"truefalse   "%{[@metadata][beat]}-%{+yyyy. MM.DD}""%{[@metadata][type]}"}}

Docker Restart Elk

At this point the logstash of slave can run normally.

To add a monitoring file:

Vi/tmp/first-pipeline.conf

= = ["/tmp/dstat.log","/var/log/messages"," /log/*.log "  =0"<your-host-name>: 9200"  ]}}

Start Logstash with the following command:

Docker exec-it Elk/opt/logstash/bin/logstash-f/tmp/first-pipeline.conf

Open the http://<your-host-name>:5601, you can display the following monitoring screen.

Elk Remote Logging Log monitoring