Master Machine Run Command:
Mkdir-p/var/log/-P/var/log/-P/var/log/-v/tmp:/tmp-v/log :/log-v/var/log:/var5601:56019200:92009300 :93005044:5044:--name Elk Sebp/elk
Only the Lagstash is turned on in slave and the related log is directed to the primary elk server:
Mkdir-p/var/log/-v/tmp:/tmp-v/log:/log-v/var/log:/var5601: 56019200:92009300:93005044:50445000 : elasticsearch_start=-e0 -e kibana_start=0 --name Elk sebp/elk
Logstash will error after startup because by default point to the local Elasticsearch service, log in to Docker to change the configuration file:
Docker exec-it elk/bin//etc/logstash/conf.d/-output.conf
= = ["<your-host-name>"truefalse "%{[@metadata][beat]}-%{+yyyy. MM.DD}""%{[@metadata][type]}"}}
Docker Restart Elk
At this point the logstash of slave can run normally.
To add a monitoring file:
Vi/tmp/first-pipeline.conf
= = ["/tmp/dstat.log","/var/log/messages"," /log/*.log " =0"<your-host-name>: 9200" ]}}
Start Logstash with the following command:
Docker exec-it Elk/opt/logstash/bin/logstash-f/tmp/first-pipeline.conf
Open the http://<your-host-name>:5601, you can display the following monitoring screen.
Elk Remote Logging Log monitoring