基于Postgress的ELK_pg 的日志与 elk 的整合-CSDN博客

本文详细介绍使用Docker Compose部署ELK Stack(包括Elasticsearch, Logstash, Kibana)的过程，涵盖配置文件详解及与PostgreSQL数据库的集成，适用于日志管理和数据分析。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

ELK的docker-compose

version: '3'
services:
  postgres:
    image: postgres:9.6
    container_name: postgres
    restart: always
    environment:
      - POSTGRES_PASSWORD=
      - TZ=Asia/Shanghai
    volumes:
      - "./config/postgres.init/:/docker-entrypoint-initdb.d:ro"
      - "./config/postgres.init/postgresql.conf:/etc/postgresql/postgresql.conf:ro"
      command: postgres -c config_file=/etc/postgresql/postgresql.conf
      ports:
        - "15432:5432"

  elasticsearch:
    image: elasticsearch:6.8.8
    container_name: elasticsearch
    restart: always
    environment:
      - cluster.name=elasticsearch
      - discovery.type=single-node
      - ES_JAVA_OPTS=-Xms512m -Xmx512m
      - TZ=Asia/Shanghai
    ports:
      - 9200:9200
      - 9300:9300

  logstash:
    image: logstash:6.8.8
    container_name: logstash
    restart: always
    environment:
      - TZ=Asia/Shanghai
    depends_on:
      - elasticsearch
    links:
      - elasticsearch:es
    volumes:
      - "./config/postgresql-42.2.5.jar:/usr/share/logstash/config/postgresql-42.2.5.jar"
      - "./config/postgresql.conf:/usr/share/logstash/config/postgresql.conf"
    command: -f /usr/share/logstash/config/postgresql.conf
    ports:
    ports:
      - 4560:4560

  kibana:
    image: kibana:6.8.8
    container_name: kibana
    restart: always
    environment:
      - elasticsearch.hosts=http://elasticsearch:9200
      - TZ=Asia/Shanghai
    links:
      - elasticsearch:es
    depends_on:
      - elasticsearch
    ports:
      - 5601:5601

Logstash的配置文件

input {
  jdbc {
    jdbc_driver_library => "/usr/share/logstash/config/postgresql-42.2.5.jar"
    jdbc_driver_class => "org.postgresql.Driver"
    jdbc_connection_string => "jdbc:postgresql://172.22.61.202:15432/dkam-taxon"
    jdbc_user => "postgres"
    jdbc_password => "postgres"
    clean_run => true

    schedule => "* * * * *"
    statement => "SELECT * from txn_tag where update_time > :sql_last_value"
    use_column_value => true
    tracking_column => "update_time"
    tracking_column_type => "timestamp"
  }
}

filter {
    json {
        source => "message"
        remove_field => ["message"]
    }

        mutate {
                remove_field =>
                ["@timestamp","@version"]
        }

}

output {
        elasticsearch {
        hosts => ["172.22.61.202:9200"]
                index => "txn_tag"
                document_id => "%{id}"
        }
}