Docker安装graylog和详解

1、安装graylog
1、创建目录
/usr/local/graylog 注意自己服务器的id

该目录下新建文件 graylog.yml 或者 compose.yml

写入内容：

version: '2'
services:
  # MongoDB: https://hub.docker.com/_/mongo/
  mongodb:
    image: mongo:3
  # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:5.6.3
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      # Disable X-Pack security: https://www.elastic.co/guide/en/elasticsearch/reference/5.6/security-settings.html#general-security-settings
      - xpack.security.enabled=false
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    mem_limit: 1g
  # Graylog: https://hub.docker.com/r/graylog/graylog/
  graylog:
    image: graylog/graylog:2.4.0-1
    environment:
      # CHANGE ME!
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      # Password: admin
      - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
      - GRAYLOG_WEB_ENDPOINT_URI=http://127.0.0.1:9000/api
    links:
      - mongodb:mongo
      - elasticsearch
    depends_on:
      - mongodb
      - elasticsearch
    ports:
      # Graylog web interface and REST API
      - 9000:9000
      # Syslog TCP
      - 514:514
      # Syslog UDP
      - 514:514/udp
      # GELF TCP
      - 12201:12201
      # GELF UDP
      - 12201:12201/udp

2、开始安装
1、如果创建的文件名字是graylog.yml 使用命令 （-d表示后台运行）

sudo docker-compose -f graylog.yml up -d

2、如此创建的文件是 compose.yml

docker-compose up -d 

2、浏览器中打开,密码admin/admin
http://localhost:9000/

3、测试
3.1、查看运行的镜像 协议观察，可以看到12201 udp这样才算成功

[root@iz2zecch299trjydpa40ypz /Users/dockertest]$ docker ps
CONTAINER ID        IMAGE                                                 COMMAND                  CREATED             STATUS              PORTS                                                                                                                    NAMES
074473c42420        graylog/graylog:2.4.0-1                               "/docker-entrypoin..."   About an hour ago   Up About an hour    0.0.0.0:514->514/tcp, 0.0.0.0:9000->9000/tcp, 0.0.0.0:514->514/udp, 0.0.0.0:12201->12201/tcp, 0.0.0.0:12201->12201/udp   dockertest_graylog_1
b2613e4c9ddd        docker.elastic.co/elasticsearch/elasticsearch:5.6.3   "/bin/bash bin/es-..."   About an hour ago   Up About an hour    9200/tcp, 9300/tcp                                                                                                       dockertest_elasticsearch_1
21651b625476        mongo:3                                               "docker-entrypoint..."   About an hour ago   Up About an hour    27017/tcp    

配置
点击 “System>Inputs”, 选择GDELF UDP之后点击Launch new input

选择Node(只有一个选项), 输入Title(可以随意输入)

点击save之后它就会出现在页面下方

点击Start input, 成功开启后就能接受日志了.

测试
启动一个docker测试日志:

设置docker的log驱动为GELF

docker run -d \
           --log-driver=gelf \
           --log-opt gelf-address=udp://localhost:12201 \
           --log-opt tag="{
  
  {.ImageName}}/{
  
  {.Name}}/{
  
  {.ID}}" \
           busybox sh -c 'while true; do echo "Hello, this is A"; sleep 10; done;'

回到Graylog Web刷新一下就能看到日志了

http协议测试

curl -XPOST http://127.0.0.1:12201/gelf -p0 -d '{"message":"这是一条消息12", "host":"127.0.0.1", "facility":"test", "topic": "meme"}'

今天的文章Docker安装graylog和详解分享到此就结束了，感谢您的阅读。