Hi,
I am new to elk stuff, I am running 3 separate docker containers (i.e. elasticsearch, kibana, and logstash). I need to specify my logstash.conf but its not working out using following docker logstash command ( I am using windows 10 with Docker desktop)
I am trying to use log4net with my webapi project to get logs to process using ELK stack
I ran the following commands to run the images
Elasticsearch:
docker run -d -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -it -h elasticsearch:7.9.2 --name elasticsearch elasticsearch:7.9.2
Kibana:
docker run -d -p 5601:5601 -h kibana:7.9.2 --name kibana --link elasticsearch:elasticsearch kibana:7.9.2
Logstash:
docker run -h logstash:7.9.2 --name logstash --link elasticsearch:elasticsearch -it --rm -v /c/Users/username/config-dir logstash:7.9.2 -f /config-dir/mylogstash.conf
(I have created following logstash file @ location c/users/username/config-dir/mylogstash.conf)
this is mylogstash.conf file
'
input {
file {
path => "C:\Testfolder\MyLoggerTest.log"
type => "log4net"
codec => multiline {
pattern => "^(DEBUG|WARN|ERROR|INFO|FATAL)"
negate => true
what => previous
}
}
}
filter {
if [type] == "log4net" {
grok {
match => [ "message", "(?m)%{LOGLEVEL:level} %{DATE:sourceTimestamp} %{DATA:logger} [%{NUMBER:threadId}] [%{IPORHOST:tempHost}] %{GREEDYDATA:tempMessage}" ]
}
mutate {
replace => [ "message" , "%{tempMessage}" ]
replace => [ "host" , "%{tempHost}" ]
remove_field => [ "tempMessage" ]
remove_field => [ "tempHost" ]
}
}
}
output {
elasticsearch {
hosts => "host.docker.internal:9200/"
index => "log4netindx"
}
}
'
I googled a lot but nothing seems to be working! I don't know how to create yaml file or interact with that (as no one shows complete way to do that) Also I am using command prompt in Admin mode.
Thanks in advance
Regards
Saj