1.安装Logstash镜像
docker pull docker.elastic.co/logstash/logstash:7.12.0
创建文件目录和配置文件
2.创建文件夹
mkdir -p /usr/local/docker/logstash
mkdir -p /usr/local/docker/logstash/config
mkdir -p /usr/local/docker/logstash/configmkdir
mkdir -p /usr/local/docker/logstash/data
mkdir -p /usr/local/docker/logstash/logs
mkdir -p /usr/local/docker/logstash/pipeline
3.创建配置文件
touch /usr/local/docker/logstash/config/jvm.options
touch /usr/local/docker/logstash/config/log4j2.properties
touch /usr/local/docker/logstash/config/logstash.conf
touch /usr/local/docker/logstash/config/logstash.yml
touch /usr/local/docker/logstash/config/piplines.yml
touch /usr/local/docker/logstash/data/test.log
4.编辑配置文件
1）jvm.options配置
编辑文件
vim jvm.options
添加配置
-Xmx512m
-Xms512m
2）logstash.yml配置
编辑配置文件
vim logstash.yml
添加配置
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: [ "http://ElasticSearchip地址:9200（ElasticSearchip端口）" ]
path.config: /usr/share/logstash/config/conf.d/*.conf
path.logs: /usr/share/logstash/logs
2）piplines.yml配置
- pipeline.id: main
path.config: "/usr/share/logstash/pipeline"
5.启动容器
1、 文件夹授权
chmod 777 /usr/local/docker/logstash/**
2、启动镜像
docker run \
--name logstash \
--restart=always \
-p 5044:5044 \
-p 9600:9600 \
-e ES_JAVA_OPTS="-Duser.timezone=Asia/Shanghai" \
-v /usr/local/docker/logstash/config:/usr/share/logstash/config \
-v /usr/local/docker/logstash/data:/usr/share/logstash/data \
-v /usr/local/docker/logstash/pipeline:/usr/share/logstash/pipeline \
-d docker.elastic.co/logstash/logstash:7.12.0
命令解释：
docker run \ 启动容器
--name logstash\ 将容器命名为 logstash
--restart=always \ 容器自动重启
-p 5044:5044 \ 将容器的5044端口映射到宿主机5044端口 logstash的启动端口
-p 9600:9600 \ 将容器的9600端口映射到宿主机9600 端口，api端口
-e ES_JAVA_OPTS="-Duser.timezone=Asia/Shanghai" \ 设置时区
-v /usr/local/docker/logstash/config:/usr/share/logstash/config \ 挂载本机配置文件目录映射到容器目录中
-v /usr/local/docker/logstash/data:/usr/share/logstash/data \ 挂载本机data目录映射到容器目录中
-v /usr/local/docker/logstash/pipeline:/usr/share/logstash/pipeline \
-d docker.elastic.co/logstash/logstash:7.12.0 后台运行容器，并返回容器ID
6. 验证是否安装成功
使用docker ps命令查询是否启动成功
使用docker exec -it logstash bash查看是否可以进入容器内部
