Use chown 1000 xxxoo xxxooo file name logtest: build: context: logtest/ volumes: - ./logtest/logs:./logs:rw networks: - elk command: | /bin/sh -c '/bin/sh -s << EOF echo "Start filebeat...." filebeat run -c ./filebeat.yml -v & sleep 2 while [ ! -f ./logs/filebeat ] do sleep 2 done chown 1000 ./logs/filebeat tail -f /dev/null EOF'
http://blog.51cto.com/kexiaoke/2092029 解决方案为在filebeat里面新增一个fields字段，service : GameStatis都是自己定义的，定义完成后使用Logstash的if 判断，条件为if [fields][service] == “GameStatis”.就可以了。
docker-compose.yml services: elasticsearch: logstash: kibana: nginx: docker-compose run ngnix docker-compose run kibana
one byte = 8 bit 4 bit => hex 0000 2*2*2*2 = 16 so one byte = 4bit + 4bit = hex + hex
https://gist.github.com/danharper/74a5102363fbd85f6b67 async () => { console.log('a'); await sleep(1000); console.log('b'); }