docker efk搭建

docker-compose.yml

version: '3.7'

services:
  elasticsearch:
    container_name: elasticsearch
    image: elasticsearch
    ports:
      - 9200:9200
      - 9300:9300

  fluentd:
    container_name: fluentd
    image: fluent/fluentd
    volumes:
      - ./fluentd/conf:/fluentd/etc
    links:
      - elasticsearch
    ports:
      - 24224:24224
      - 24224:24224/udp

  kibana:
    image: kibana
    links:
      - elasticsearch
    ports:
      - 5601:5601

  nginx:
    image: nginx
    ports:
      - 80:80
    links:
      - fluentd
    logging:
      driver: "fluentd"
      options:
        fluentd-address: localhost:24224
        tag: nginx-access

創建目錄
fluentd/conf
在目錄創建文件

fluent.conf 注意文件名不可更改

<source>
    @type forward
    port 24224
    bind 0.0.0.0
</source>

<match *.**>
    @type copy
    <store>
        @type elasticsearch
        host elasticsearch
        port 9200
        logstash_format true
        logstash_prefix fluentd
        logstash_dataformat %Y%m%d
        include_tag_key true
        type_name access_log
            type_key @log_name
        flush_interval 1s
    </store>
    <store>
        @type stdout
    </store>
</match>