docker - 重新使用 docker-compose ELK 堆栈中的现有卷

Question

我正在尝试重新使用现有的 ES 卷，其中包含几天的日志。
但无法弄清楚如何。对 docker-compose 的经验几乎为零。

在尝试运行 docker-compose up 时，我得到:

ERROR: for elasticsearch  Cannot start service elasticsearch: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:245: running exec setns process for init caused \"exit status 17\""
Starting kibana ... error

ERROR: for kibana  Cannot start service kibana: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:245: running exec setns process for init caused \"exit status 17\""


ERROR: for elasticsearch  Cannot start service elasticsearch: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:245: running exec setns process for init caused \"exit status 17\""


ERROR: for kibana  Cannot start service kibana: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:245: running exec setns process for init caused \"exit status 17\""

ERROR: Encountered errors while bringing up the project.

这是我的规范:

version: "3"
services:
  nginx:
    image: nginx:alpine
    container_name: nginx
    command: nginx -g "daemon off;"
    volumes:
    - ./nginx/config/conf.d:/etc/nginx/conf.d
    ports:
      - "8080:8080"
    links:
      - kibana

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.7.0
    container_name: elasticsearch
    environment:
      - "ES_JAVA_OPTS=-Xms6g-Xmx6g"
    volumes:
      - ./elasticsearch:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"
      - "9300:9300"

  logstash:
    build: logstash/
    command: logstash -f /etc/logstash/conf.d/logstash.conf
    container_name: logstash
    environment:
      - "LS_JAVA_OPTS=-Xmx256m -Xms256m"

    volumes:
      - ./logstash/config:/etc/logstash/conf.d
    ports:
      - "5000:5000"
      - "5044:5044"
    links:
      - elasticsearch

  kibana:
    build: kibana/
    container_name: kibana
    volumes:
      - ./kibana/config:/opt/kibana/config
    ports:
      - "5601:5601"

volumes:
  elasticsearch:
    driver: local

另外，我尝试过:

volumes:
  elasticsearch:
    driver: local
    driver_opts:
      type: 'none'
      o: 'bind'
      device: '/myfolder/elasticsearch/storage/'

版本:

docker-compose version 1.18.0, build 8dd22a9

我创建了卷:

docker volume create elasticsearch

并尝试删除该/var/lib/docker/volumes/xxxxx 文件夹并对我的卷进行符号链接(symbolic link)，但没有这样做。

是否可以？我将卷连接到主机，没有其他东西在运行，也没有旧的图像/卷。它将只有 ELK 堆栈，其中包含此卷，其中包含现有数据。

谢谢

Answer 1

由于我们无法重新索引附加卷的数据，我们决定从头开始，更新版本，构建另一个 docker-compose 文件并让 filebeat 从服务器中提取日志文件。不利的一面是，这些导入的日志从导入时开始获取日期，但在其中一个字段中有一个带有实际日期的时间戳。