收集多个容器日志并拆分访问类型

配置步骤：

按服务类型拆分docker容器日志

1.安装docker-compose

yum install -y python2-pip

2.这里使用pip安装，默认源为国外，可以使用国内加速，相关网站

https://mirrors.tuna.tsinghua.edu.cn/help/pypi/
pip加速操作命令
pip install -i https://pypi.tuna.tsinghua.edu.cn/simple pip -U
pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple

3.继续安装docker-compose

pip install docker-compose

4.检查

docker-compose version

5.修改filebeat配置文件

filebeat.inputs:
- type: log 
  enabled: true 
  paths:
    - /var/lib/docker/containers/*/*-json.log
  json.keys_under_root: true
  json.overwrite_keys: true

setup.kibana:
  host: "10.0.0.51:5601"

output.elasticsearch:
  hosts: ["10.0.0.51:9200"]
  indices:
    - index: "docker-nginx-access-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        attrs.service: "nginx"
        stream: "stdout"
    - index: "docker-nginx-error-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        attrs.service: "nginx"
        stream: "stderr"
    - index: "docker-mysql-access-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        attrs.service: "mysql"
        stream: "stdout"
    - index: "docker-mysql-error-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        attrs.service: "mysql"
        stream: "stderr"

setup.template.name: "docker"
setup.template.pattern: "docker-*"
setup.template.enabled: false
setup.template.overwrite: true