Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
A docker-compose set up that has nginx -> ELK through RabbitMQ
input {
rabbitmq {
host => "rabbitmq"
exchange => "logstash"
exchange_type => "direct"
key => "logstash"
durable => true
}
}
output {
elasticsearch {
hosts => ["localhost"]
manage_template => false
index => "logstash-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
stdout {
codec => rubydebug
}
}
version: '3'
services:
rabbitmq:
image: rabbitmq:alpine
ports:
- "15672:15672"
nginx:
image: nginx
ports:
- "8080:80"
labels:
- "filebeat.stdin=true"
logstash:
image: logstash:alpine
command: "logstash -f /logstash.conf"
volumes:
- "./logstash.conf:/logstash.conf:ro"
links:
- rabbitmq
elk:
image: sebp/elk
volumes:
- "./03-rabbitmq-input.conf:/etc/logstash/conf.d/03-rabbitmq-input.conf:ro"
- "./30-output.conf:/etc/logstash/conf.d/30-output.conf:ro"
ports:
- "5601:5601"
links:
- rabbitmq
filebeat:
image: willfarrell/filebeat:5-stdin
environment:
HOSTNAME: "filebeat"
LOGSTASH_HOST: "logstash"
volumes:
- "/var/run/docker.sock:/tmp/docker.sock"
- "./filebeat.yml:/etc/filebeat/filebeat.yml:ro"
links:
- logstash
filebeat.prospectors:
- input_type: 'stdin'
document_type: 'nginx-access'
output:
console:
pretty: true
logstash:
hosts: ["${LOGSTASH_HOST:logstash}:${LOGSTASH_PORT:5044}"]
index: filebeat
input {
beats {
port => 5044
}
}
output {
rabbitmq {
host => "rabbitmq"
exchange => "logstash"
exchange_type => "direct"
durable => true
key => "logstash"
}
stdout {
codec => rubydebug
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.