EFK系统是基于docker构建的，但是fluidd无法启动

Question

我想通过 docker compose 构建 efk 记录器系统。\n一切都已设置，只有 fluidd 有问题。

\n

fluidd docker 容器日志

\n

\n

2022-02-15 02:06:11 +0000 [info]：解析配置文件成功path =“/ Fluentd/etc/ Fluent.conf”

\n

\n

\n

2022-02-15 02:06:11 +0000 [信息]: gem 'fluid-plugin-elasticsearch' 版本 '5.0.3'

\n

\n

\n

2022-02-15 02:06:11 +0000 [信息]: gem 'fluidd' 版本 '1.12.0'

\n

\n

\n

/usr/local/lib/ruby/2.6.0/rubygems/core_ext/kernel_require.rb:54:in `require': 无法加载此类文件 -- elasticsearch/transport/transport/connections/selector (LoadError)

\n

\n

我的目录：

\n

\n 我的项目/\n \xe2\x94\x9c\xe2\x94\x80 fluidd/\n \xe2\x94\x82 \xe2\x94\x9c\xe2\x94\x80 conf/\n \xe2\x94\ x82 \xe2\x94\x82 \xe2\x94\x94\xe2\x94\x80\xe2\x94\x80 Fluent.conf\n \xe2\x94\x82 \xe2\x94\x94\xe2\x94\x80\xe2 \x94\x80 Dockerfile\n \xe2\x94\x94\xe2\x94\x80\xe2\x94\x80 docker-compose.yml\n

\n

docker-compose.yml：

\n

version: "3"\nservices:\n  web:\n    image: httpd\n    ports:\n      - "8010:80"\n    depends_on:\n      - fluentd\n    logging:\n      driver: "fluentd"\n      options:\n        fluentd-address: 127.0.0.1:24224\n        fluentd-async: 'true'\n        tag: httpd.access\n\n  fluentd:\n    build: ./fluentd\n    volumes:\n      - ./fluentd/conf:/fluentd/etc\n    links:\n      - "elasticsearch"\n    ports:\n      - "24224:24224"\n      - "24224:24224/udp"\n\n  elasticsearch:\n    image: docker.elastic.co/elasticsearch/elasticsearch:7.13.1\n    environment:\n      - discovery.type=single-node\n    expose:\n      - 9200\n    ports:\n      - "9200:9200"\n\n  kibana:\n    image: docker.elastic.co/kibana/kibana:7.13.1\n    links:\n      - "elasticsearch"\n    ports:\n      - "5601:5601"\n

\n

Dockerfile：

\n

# fluentd/Dockerfile\n\nFROM fluent/fluentd:v1.12.0-debian-1.0\nUSER root\nRUN ["gem", "install", "fluent-plugin-elasticsearch", "--no-document", "--version", "5.0.3"]\nUSER fluent\n

\n

流利的.conf：

\n

<source>\n  @type forward\n  port 24224\n  bind 0.0.0.0\n</source>\n\n<match *.**>\n  @type copy\n\n  <store>\n    @type elasticsearch\n    host elasticsearch\n    port 9200\n    logstash_format true\n    logstash_prefix fluentd\n    logstash_dateformat %Y%m%d\n    include_tag_key true\n    type_name access_log\n    tag_key @log_name\n    flush_interval 1s\n  </store>\n\n  <store>\n    @type stdout\n  </store>\n</match>\n

\n

Answer 1

更新：新版本fluent-plugin-elasticsearch修复了该问题，因此您可以安装fluent-plugin-elasticsearch>= 5.20

如果您无法使用较新的插件版本或有其他问题，您仍然可以使用旧的解决方案：

看来elasticsearch 8.0打破了这个功能。您可以等待修复，在等待期间只需添加类似的内容：

FROM fluent/fluentd:v1.12.0-debian-1.0
USER root
RUN gem uninstall -I elasticsearch && gem install elasticsearch -v 7.17.0
RUN ["gem", "install", "fluent-plugin-elasticsearch", "--no-document", "-- 
 version", "5.0.3"]
USER fluent

Answer 2

我遇到了同样的问题，我通过将fluent-plugin-elasticsearch版本更新Dockerfile到5.2.0解决了它。