Docker Filebeat Nginx日志

Question

我使用filebeat作为docker，当ıpoint我的nginx登录filebeat时。ymlım在kibana看不到nginx日志这是我的filebeat。yml。我准备好了elastichsearch和kibana容器。当我在日志中启动filebeat容器时，它表示已配置给定的日志路径。但ı无法在kibana上看到任何nginx日志

  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

# filebeat.autodiscover:
#   providers:
#     - type: docker
#       hints.enabled: true

filebeat.autodiscover:
    providers:
      - type: docker
        hints.enabled: true
        templates:
          - condition:
              contains:
                docker.container.image: nginx
            config:
              - type: docker
                containers.ids:
                    - "${data.docker.container.id}"
              - module: nginx
                access:
                  enabled: true
                  var.paths: ["/var/log/nginx/user_service_access.log"]
                  containers:
                      stream: "stdout"
                error:
                  enabled: true
                  var.paths: ["/var/log/nginx/user_service_access.log"]
                  containers:
                      stream: "stderr"
                      
processors:
- add_cloud_metadata: ~

output.elasticsearch:
  hosts: '${ELASTICSEARCH_HOSTS:ip_address:9200}'

以及我的nginx站点配置的一个例子

    listen 80;
    listen [::]:80;

    # For https
    # listen 443 ssl;
    # listen [::]:443 ssl ipv6only=on;
    # ssl_certificate /etc/nginx/ssl/default.crt;
    # ssl_certificate_key /etc/nginx/ssl/default.key;

    server_name user_service.test;
    root /var/www/user_service/public;
    index index.php index.html index.htm;

    location / {
        try_files $uri $uri/ /index.php$is_args$args;
        proxy_pass http://ip_address:5601;
    }

    location ~ \.php$ {
        try_files $uri /index.php =404;
        fastcgi_pass php-upstream;
        fastcgi_index index.php;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        #fixes timeouts
        fastcgi_read_timeout 600;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }

    location /.well-known/acme-challenge/ {
        root /var/www/letsencrypt/;
        log_not_found off;
    }

    error_log /var/log/nginx/user_service_error.log;
    access_log /var/log/nginx/user_service_access.log;
}```

Answer 1

尝试在调试模式下运行filebeat，以检查filebeat配置中的任何故障。从filebeat主页，尝试运行：

filebeat -e -c filebeat.yml -d "*"

Answer 2

filebeat 7.9的自动发现配置。x看起来像这样，它允许从容器的流中解析nginx日志

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
      templates:
        - condition.contains:
            docker.container.image: nginx
          config:
            - module: nginx
              access.input:
                type: docker
                containers:
                  ids: "${data.docker.container.id}"
                  stream: "stdout"
              error.input:
                type: docker
                containers:
                  ids: "${data.docker.container.id}"
                  stream: "stderr"