方式一

1.启动2个nginx容器

docker run -d -p 80:80 nginx
docker run -d -p 8080:80 nginx

2.修改filebeat配置文件

filebeat.inputs:
- type: docker
  containers.ids: 
    - '*'

output.elasticsearch:
  hosts: ["172.16.1.161:9200","172.16.1.162:9200","172.16.1.163:9200"]
  indices:
    - index: "docker_nginx_access-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        stream: "stdout"
    - index: "docker_nginx_error-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        stream: "stderr"

setup.template.name: "docker"
setup.template.pattern: "docker_*"
setup.template.enabled: false
setup.template.overwrite: true

3.重启filebeat

systemctl restart filebeat

4.访问docker容器产生日志测试

5.es-head和kibana查看

filebeat收集Docker

原文：https://www.cnblogs.com/xuliangwei/p/12172960.html