日志聚合与系统监控部署（ELK Stack）

当服务器数量增加，日志分散在各节点 becomes unmanageable。本文部署 ELK Stack（Elasticsearch, Logstash, Kibana）实现日志聚合和分析。

Docker Compose 部署

version: 3.8

services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
    volumes:
      - es_data:/usr/share/elasticsearch/data
    ports:
      - 9200:9200

  logstash:
    image: docker.elastic.co/logstash/logstash:8.11.0
    volumes:
      - ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf
    depends_on:
      - elasticsearch

  kibana:
    image: docker.elastic.co/kibana/kibana:8.11.0
    ports:
      - 5601:5601
    depends_on:
      - elasticsearch

volumes:
  es_data:

Filebeat 配置（日志收集）

filebeat.inputs:
- type: log
  paths:
    - /var/log/nginx/*.log
    - /app/logs/*.log

output.logstash:
  hosts: ["localhost:5044"]

实用技巧

• 设置日志轮转（logrotate）防止磁盘占满
• 使用索引生命周期管理（ILM）自动清理旧日志
• 配置 Kibana Dashboard 可视化错误率和响应时间