搭建elk环境并接入frostmourne，实现监控报警效果（五）

#修改权限目录,id 1000的账号

chown -R meng.meng data*

chmod -R 777 data*

#docker-compose.yaml

version: '3.8' services: filebeat: # 镜像名称 image: docker.elastic.co/beats/filebeat:8.6.0 # 容器名称 hostname: filebeat container_name: filebeat #ports: # - 5044:5044 volumes: - /data/elk_monitor/filebeat:/usr/share/filebeat # - /var/log/messages:/var/log/messages - /data/logs:/data/logs networks: - meta deploy: replicas: 1 networks: meta: external: true # 用已经创建好的网络

#启动

docker-compose up -d

#测试

setup.kibana: host: "192.168.10.14:5601" output.elasticsearch.allow_older_versions: true filebeat.inputs: - input_type: log paths: - /data/logs/t1.log json.keys_under_root: true json.overwrite_keys: true fields: index: 't1_history' - input_type: log paths: - /data/logs/t2.log json.keys_under_root: true json.overwrite_keys: true fields: index: 't2_history' output.elasticsearch: hosts: ["192.168.10.14:9200"] username: "elastic" password: "vsUZGKNvjWRtTKPmDG"110120 indices: - index: "t1_history" when.contains: fields: index: "t1_history" - index: "t2_history" when.contains: fields: index: "t2_history"