Monitoring Logstash running from docker container


(Wei-Li) #1

Logstash 5 supports node stats monitoring

https://www.elastic.co/guide/en/logstash/5.0/node-stats-api.html

However, I am having trouble making it work with logstash running from container.
I use docker compose to start logstash container, and forward port 9600 to 9601 in the docker-compose file

logstash_in:
image: logstash:5
command: sh -c "logstash -f /usr/local/logstash_in/config"
volumes:
- ./input_data:/etc/data
- /opt/kf/logstash_in/config:/usr/local/logstash_in/config
ports:
- "5001:5000"
- "8086:8080"
- "9601:9600"
links:
- kf-shield-es-storage:elasticsearch
- kf-shield-agent:namekocluster
- kf-rabbitmq:messagebroker
networks:
- front
depends_on:
- kf-shield-es-storage
- kf-shield-agent
logging:
driver: "json-file"
options:
max-size: "2g"

I can see the port forwarding from "docker ps"

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
bfd96e262022 logstash:5 "/docker-entrypoint.s" 9 seconds ago Up 2 seconds 0.0.0.0:5001->5000/tcp, 0.0.0.0:8086->8080/tcp, 0.0.0.0:9601->9600/tcp kf_logstash_in_1

In the logstash config, I merely stated the input port 8080 for the application, so I don't think it has anything to do with monitoring, and I shouldn't need to add additional config for monitoring to work.

input {
http {
host => "0.0.0.0"
port => "8080"
id => "http_api"
}

When I curl the port 9601, I got "Connection reset by peer" error.

curl -XGET 127.0.0.1:9601/_node/stats/jvm
curl: (56) Recv failure: Connection reset by peer

The API works if I execute it within the container

docker exec -it $(docker ps -aqf "name=logstash_in") curl 127.0.0.1:9600 | python -m json.tool
{
"build_date": "2018-01-25T22:39:45+00:00",
"build_sha": "60c90edbb03bac3f472d11540dbebd575212ac44",
"build_snapshot": false,
"host": "bfd96e262022",
"http_address": "127.0.0.1:9600",
"id": "bd714795-bd6a-493a-b84c-9c2fef9e85b9",
"name": "bfd96e262022",
"version": "5.6.7"
}

I don't think there is limitation on getting logstash stats with docker deployment, but I don't know which part I miss here.


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.