$ sudo docker pull elasticsearch:5.5.0

$ sudo docker run -it -d -p 9200:9200 -p 9300:9300 -v ~/elasticsearch/data:/usr/share/elasticsearch/data --name myes elasticsearch:5.5.0

$ docker logs -f myes

$ sudo docker pull logstash:5.5.0

$ mkdir ~/logstash/conf.d && cd logstash/conf.d
$ vim logstash.conf

input {

 beats {
  port => 5044 # 此端口需要与 filebeat.yml 中的端口相同
 }

 file {
  path => "/data/logs"
  # start_position => "beginning"
 }
}

filter {
 #grok {
 # match => { "message" => "%{COMBINEDAPACHELOG}" }
 #}
 #date {
 # match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
 #}

 grok {

  patterns_dir => "/etc/logstash/conf.d/patterns"
  match => {"message" => "%{TIMESTAMP_ISO8601:time}\S%{MYSELF:msgid}%{MYSELF:method}%{MYDATA:data}%{MYSELF:UserInfo}\S%{LOGLEVEL:level}\S%{MYSELF:thread}%{MYSELF:application}%{MYSELF:ip}"}
}
date {
   #match => [ "time", "YYYY-MM-dd HH:mm:ss,SSS" ]
   match => [ "time", "ISO8601" ]
   target => "@timestamp"
   timezone => "Asia/Phnom_Penh"
 }

}

output {

 stdout {
  codec => rubydebug
 }

 elasticsearch {
  action => "index"
  hosts => ["172.17.10.114:9200"]
  index => "%{[fields][indexname]}-%{+YYYY.MM.dd}"
 }
}

$ sudo docker run -it -d -p 5044:5044 -v ~/logstash/conf.d:/etc/logstash/conf.d -v ~/logstash/data/logs:/data/logs --name logstash logstash:5.5.0 -f /etc/logstash/conf.d/logstash.conf

$ sudo docker pull kibana:5.5.0

$ mkdir ~/kibana && cd ~/kibana
$ vim kibana.yml

server.port: 5601
server.host: "0.0.0.0"
elasticsearch.url: "http://172.17.10.114:9200"

$ sudo docker run -it -d -p 5601:5601 -v ~/kibana:/etc/kibana --name kibana kibana:5.5.0

$ sudo docker pull docker.elastic.co/beats/filebeat:5.5.0

filebeat.prospectors:
- type: log
  paths:
   - ~/filebeat/logs # 指定需要收集的日志文件的路径
fields:
  indexname: xxx # 这里填写项目名称，对应index => "%{[fields][indexname]}-%{+YYYY.MM.dd}"
output.logstash:
 hosts: ["172.17.10.114:5044"]

$ sudo docker run -it -d -v ~/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml --name filebeat docker.elastic.co/beats/filebeat:5.5.0