docker & docker-compose 一堆坑 FROM alpine RUN apk –no-cache upgrade RUN apk update &&\ apk add bash

Use chown 1000 xxxoo xxxooo file name logtest: build: context: logtest/ volumes: - ./logtest/logs:./logs:rw networks: - elk command: | /bin/sh -c '/bin/sh -s << EOF echo "Start filebeat...." filebeat run -c ./filebeat.yml -v & sleep 2 while [ ! -f ./logs/filebeat ] do sleep 2 done chown 1000 ./logs/filebeat tail -f /dev/null EOF'

http://blog.51cto.com/kexiaoke/2092029 解决方案为在filebeat里面新增一个fields字段，service : GameStatis都是自己定义的，定义完成后使用Logstash的if 判断，条件为if [fields][service] == “GameStatis”.就可以了。

docker-compose.yml services: elasticsearch: logstash: kibana: nginx: docker-compose run ngnix docker-compose run kibana

one byte = 8 bit 4 bit => hex 0000 2*2*2*2 = 16 so one byte = 4bit + 4bit = hex + hex