使用docker将filebeat连接到elasticsearch：连接被拒绝

Question

我是新来的论坛，以及麋鹿堆栈。我试着用docker设置麋鹿堆。我成功了，然后我将filebeat添加到了撰写文件中。从那以后，filebeat就导致了连接到其他容器的问题。最初，我将其配置为将日志发送到logstash，但在所有故障排除之后，当我仍然无法让filebeat与logstash对话时，我完全删除了logstash，并尝试将filebeat直接与elasticsearch连接。在尽了我所能之后，当我检查filebeat容器的日志时，我看到的只是“无法连接到backoff（elasticsearch）(http://elasticsearch:9200))：获取“http://elasticsearch:9200“：dial tcp 192.168.128.2:9200:connect:connection-searked”当我在elasticsearch中检查索引时，我在那里看到了filebeat。我还可以从filebeat容器中ping到elasticsearch（与logstash相同，我可以从内部ping logstash）。

即使从堆栈中删除了logstash，我仍然在elasticsearch中看到logstash索引。不知道为什么！

请告诉我哪里出了问题。任何帮助都将不胜感激。提前谢谢！

这是我的档案节拍。yml

    ``` filebeat.inputs:
         - type: docker
           containers:
             path: "/usr/share/dockerlogs/data"
             stream: "stdout"
             ids:
               - "*"
             cri.parse_flags: true
             combine_partial: true
             exclude_files: ['\.gz$']
        processors:
         - add_docker_metadata:
             host: "unix:///var/run/docker.sock"
        filebeat.config.modules:
          path: ${path.config}/modules.d/*.yml
          reload.enabled: false
        #output.logstash:
           #hosts: ["logstash:5044"]
        output.elasticsearch:
          hosts: ["elasticsearch:9200"]
          username: elastic
          password: changeme
        log files:
        logging.level: error
        logging.to_files: false
        logging.to_syslog: false
        logging.metrics.enabled: false
        logging.files:
          path: /var/log/filebeat
          name: filebeat
          keepfiles: 7
          permissions: 0644
        ssl.verification_mode: none
        setup.kibana:
          host: "kibana:5601"
    ```

这是我的弹性搜索。yml

    ``` ---
     ## Default Elasticsearch configuration from Elasticsearch base image.
     ## https://github.com/elastic/elasticsearch/blob/master/distribution/ docker/src/docker/
     ## config/elasticsearch.yml
     cluster.name: "docker-cluster"
     network.host: 0.0.0.0
     http.port: 9200
     #network.host: 142.93.218.7
     ## X-Pack settings
     ## see https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-xpack.html
     #
     xpack.license.self_generated.type: basic
     xpack.security.enabled: true
     xpack.monitoring.collection.enabled: true
    ```

这是我的码头工人。yml：

version: '3.2'

services:
  elasticsearch:
    build:
      context: elasticsearch/
      args:
        ELK_VERSION: $ELK_VERSION
    volumes:
      - type: bind
        source: ./elasticsearch/config/elasticsearch.yml
        target: /usr/share/elasticsearch/config/elasticsearch.yml
        read_only: true
      - type: volume
        source: elasticsearch
        target: /usr/share/elasticsearch/data
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      ES_JAVA_OPTS: "-Xmx256m -Xms256m"
      ELASTIC_PASSWORD: changeme
      # Use single node discovery in order to disable production mode and avoid bootstrap checks.
      # see: https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks.html
      discovery.type: single-node
    networks:
      - elk

  #logstash:
    #build:
      #context: logstash/
      #args:
        #ELK_VERSION: $ELK_VERSION
    #volumes:
      #- type: bind
        #source: ./logstash/config/logstash.yml
        #target: /usr/share/logstash/config/logstash.yml
        #read_only: true
      #- type: bind
        #source: ./logstash/pipeline
        #target: /usr/share/logstash/pipeline
        #read_only: true
    #ports:
      #- "5000:5000"
      #- "9600:9600"
      #- "5044:5044"
    #environment:
      #LS_JAVA_OPTS: "-Xmx256m -Xms256m"
    #depends_on:
      #- elasticsearch
    #networks:
      #- elk

  filebeat:
    build:
     context: filebeat-docker/
     # args:
       # ELK_VERSION: $ELK_VERSION
    # Run as 'root' instead of 'metricbeat' (uid 1000) to allow reading
    # 'docker.sock' and the host's filesystem.
    user: root
    #ports:
    #- "5044:5044"
    command:
        # Log to stderr.
      - -e
        # Disable config file permissions checks. Allows mounting
        # 'config/metricbeat.yml' even if it's not owned by root.
        # see: https://www.elastic.co/guide/en/beats/libbeat/current/config-file-permissions.html
      - --strict.perms=false
        # Mount point of the host’s filesystem. Required to monitor the host
        # from within a container.
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/lib/docker/containers:/usr/share/dockerlogs/data:ro
      #- /var/lib/docker:/var/lib/docker:ro
    networks:
      - elk
    depends_on:
      #- logstash
      - elasticsearch
      - kibana

  kibana:
    build:
      context: kibana/
      args:
        ELK_VERSION: $ELK_VERSION
    volumes:
      - type: bind
        source: ./kibana/config/kibana.yml
        target: /usr/share/kibana/config/kibana.yml
        read_only: true
    ports:
      - "5601:5601"
    networks:
      - elk
    depends_on:
      - elasticsearch

networks:
  elk:
    external: true

这些是filebeat容器日志：

2021-07-26T08:54:34.833Z        ERROR   [publisher_pipeline_output]     pipeline/output.go:154  Failed to connect to backoff(elasticsearch(http://elasticsearch:9200)): Get "http://elasticsearch:9200": dial tcp 192.168.128.2:9200: connect: connection refused
2021-07-26T08:54:56.139Z        ERROR   [publisher_pipeline_output]     pipeline/output.go:154  Failed to connect to backoff(elasticsearch(http://elasticsearch:9200)): Get "http://elasticsearch:9200": dial tcp 192.168.128.2:9200: connect: connection refused

Answer 1

在弹性搜索中。yml您可以通过网络设置主机名。主持人：localhost。

将其设置为主机的IP地址或docker服务的名称

Answer 2

你试过设置网络吗。在你的elasticsearch中主持。yml到127.0.0.1（如果您的所有设备都在同一台机器上）或到您机器的IP？