docker和docker-compose的安装这里不做介绍，请自行百度

1.下载filebeat镜像

docker pull docker.elastic.co/beats/filebeat:6.1.3

2.filebeat配置

name: filebeat-1 #默认为主机名，可自行设置
setup.template.name: "filebeat_test_log"
setup.template.pattern: "merit_test_log-*"
setup.template.enabled: true
filebeat.prospectors:
- type: log
  fields:
    type: "filebeat"
  tags: ["filebeat"]
  encoding: utf-8
  scan_frequency: 10s
  force_close_files: true
  paths:
    - /filebeat/*.log    # /filebeat为docker-compose映射路径
  multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after
output.elasticsearch:
  hosts: ["127.0.0.0:9200"]
  index: "merit_test_log-%{+yyyy.MM.dd}"

3.docker-compose配置

filebeat:
  image: docker.elastic.co/beats/filebeat:6.1.3
  privileged: false
  restart: always
  volumes:
  - /opt/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml 
  - /opt/log/filebeat:/filebeat #/opt/log/filebeat为本机物理地址
  environment:
  - TZ=Asia/Shanghai

4.docker-compose启动