From 08360215335d5642e5c4b75648ab70fb46a53815 Mon Sep 17 00:00:00 2001 From: Michael Tarleton Date: Mon, 13 Jun 2016 18:06:22 -0500 Subject: [PATCH 1/6] Created Dockerfile for the logstash image build. --- docker-compose.yml | 3 ++- logstash/Dockerfile | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 logstash/Dockerfile diff --git a/docker-compose.yml b/docker-compose.yml index 863a109..72237bb 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -4,8 +4,9 @@ elasticsearch: ports: - "9200:9200" - "9300:9300" + logstash: - image: logstash:latest + build: logstash/ command: logstash -f /etc/logstash/conf.d/logstash.conf volumes: - ./logstash/config:/etc/logstash/conf.d diff --git a/logstash/Dockerfile b/logstash/Dockerfile new file mode 100644 index 0000000..5419695 --- /dev/null +++ b/logstash/Dockerfile @@ -0,0 +1 @@ +FROM logstash:latest \ No newline at end of file From d84dfb34e072afe77c7ef1d93e35096436d22d91 Mon Sep 17 00:00:00 2001 From: Michael Tarleton Date: Mon, 13 Jun 2016 18:13:21 -0500 Subject: [PATCH 2/6] Installed and configured the logstash-filter-json filter for message parsing in JSON out of the box. --- logstash/Dockerfile | 5 ++++- logstash/config/logstash.conf | 7 +++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/logstash/Dockerfile b/logstash/Dockerfile index 5419695..920e1ae 100644 --- a/logstash/Dockerfile +++ b/logstash/Dockerfile @@ -1 +1,4 @@ -FROM logstash:latest \ No newline at end of file +FROM logstash:latest + +# Install plugins +RUN logstash-plugin install logstash-filter-json \ No newline at end of file diff --git a/logstash/config/logstash.conf b/logstash/config/logstash.conf index 5718b33..72ac623 100644 --- a/logstash/config/logstash.conf +++ b/logstash/config/logstash.conf @@ -6,6 +6,13 @@ input { ## Add your filters here +# Added a default json filter for parsing the "message" field +filter { + json { + source => "message" + } +} + output { elasticsearch { hosts => "elasticsearch:9200" From 7a49c1681f8d0b37e55468a44729377e71e3a4a2 Mon Sep 17 00:00:00 2001 From: Michael Tarleton Date: Mon, 13 Jun 2016 18:13:44 -0500 Subject: [PATCH 3/6] Updated README with the new additions. --- README.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index e99dd3b..07a7d81 100644 --- a/README.md +++ b/README.md @@ -95,7 +95,7 @@ If you want to override the default configuration, add the *LS_HEAP_SIZE* enviro ```yml logstash: - image: logstash:latest + build: logstash/ command: logstash -f /etc/logstash/conf.d/logstash.conf volumes: - ./logstash/config:/etc/logstash/conf.d @@ -107,6 +107,13 @@ logstash: - LS_HEAP_SIZE=2048m ``` +## How can I add Logstash plugins? ## + +To add plugins to logstash you have to: + +1. Add a RUN statement to the `logstash/Dockerfile` (ex. `RUN logstash-plugin install logstash-filter-json`) +2. Add the associated plugin code to the `logstash/config/logstash.conf` file + ## How can I enable a remote JMX connection to Logstash? As for the Java heap memory, another environment variable allows to specify JAVA_OPTS used by Logstash. You'll need to specify the appropriate options to enable JMX and map the JMX port on the docker host. @@ -115,7 +122,7 @@ Update the container in the `docker-compose.yml` to add the *LS_JAVA_OPTS* envir ```yml logstash: - image: logstash:latest + build: logstash/ command: logstash -f /etc/logstash/conf.d/logstash.conf volumes: - ./logstash/config:/etc/logstash/conf.d From 5e66f83fd05a2dee38a4c5d0339a94a4bfef2d94 Mon Sep 17 00:00:00 2001 From: Michael Tarleton Date: Mon, 13 Jun 2016 20:50:19 -0500 Subject: [PATCH 4/6] Removed the json plugin and updated the README. --- README.md | 2 +- logstash/Dockerfile | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 07a7d81..6dc5dda 100644 --- a/README.md +++ b/README.md @@ -112,7 +112,7 @@ logstash: To add plugins to logstash you have to: 1. Add a RUN statement to the `logstash/Dockerfile` (ex. `RUN logstash-plugin install logstash-filter-json`) -2. Add the associated plugin code to the `logstash/config/logstash.conf` file +2. Add the associated plugin code configuration to the `logstash/config/logstash.conf` file ## How can I enable a remote JMX connection to Logstash? diff --git a/logstash/Dockerfile b/logstash/Dockerfile index 920e1ae..10d3bdb 100644 --- a/logstash/Dockerfile +++ b/logstash/Dockerfile @@ -1,4 +1,4 @@ FROM logstash:latest -# Install plugins -RUN logstash-plugin install logstash-filter-json \ No newline at end of file +# Add your logstash plugins setup here +# Example: RUN logstash-plugin install logstash-filter-json \ No newline at end of file From 997f42403cf16951a5464258f2b0c6171cfd489b Mon Sep 17 00:00:00 2001 From: Michael Tarleton Date: Mon, 13 Jun 2016 20:51:21 -0500 Subject: [PATCH 5/6] Removed the json plugin example from the logstash config. --- logstash/config/logstash.conf | 7 ------- 1 file changed, 7 deletions(-) diff --git a/logstash/config/logstash.conf b/logstash/config/logstash.conf index 72ac623..5718b33 100644 --- a/logstash/config/logstash.conf +++ b/logstash/config/logstash.conf @@ -6,13 +6,6 @@ input { ## Add your filters here -# Added a default json filter for parsing the "message" field -filter { - json { - source => "message" - } -} - output { elasticsearch { hosts => "elasticsearch:9200" From 21bd2e458cb1fc4db2baf0e3befc79d11213828c Mon Sep 17 00:00:00 2001 From: Michael Tarleton Date: Mon, 13 Jun 2016 22:04:00 -0500 Subject: [PATCH 6/6] Updated comment on logstash.conf --- logstash/config/logstash.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/logstash/config/logstash.conf b/logstash/config/logstash.conf index 5718b33..10e442e 100644 --- a/logstash/config/logstash.conf +++ b/logstash/config/logstash.conf @@ -4,7 +4,7 @@ input { } } -## Add your filters here +## Add your filters / logstash plugins configuration here output { elasticsearch {