docker - Re using existing volume at docker-compose ELK stack

Question

I'm trying to re use an existing ES volume with several days of logs in it. But can't figure it out how. Have little to zero experience with docker-compose.

While trying to run docker-compose up I get:

ERROR: for elasticsearch  Cannot start service elasticsearch: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:245: running exec setns process for init caused \"exit status 17\""
Starting kibana ... error

ERROR: for kibana  Cannot start service kibana: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:245: running exec setns process for init caused \"exit status 17\""


ERROR: for elasticsearch  Cannot start service elasticsearch: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:245: running exec setns process for init caused \"exit status 17\""


ERROR: for kibana  Cannot start service kibana: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:245: running exec setns process for init caused \"exit status 17\""

ERROR: Encountered errors while bringing up the project.

Here's my spec:

version: "3"
services:
  nginx:
    image: nginx:alpine
    container_name: nginx
    command: nginx -g "daemon off;"
    volumes:
    - ./nginx/config/conf.d:/etc/nginx/conf.d
    ports:
      - "8080:8080"
    links:
      - kibana

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.7.0
    container_name: elasticsearch
    environment:
      - "ES_JAVA_OPTS=-Xms6g-Xmx6g"
    volumes:
      - ./elasticsearch:/usr/share/elasticsearch/data
    ports:
      - "9200:9200"
      - "9300:9300"

  logstash:
    build: logstash/
    command: logstash -f /etc/logstash/conf.d/logstash.conf
    container_name: logstash
    environment:
      - "LS_JAVA_OPTS=-Xmx256m -Xms256m"

    volumes:
      - ./logstash/config:/etc/logstash/conf.d
    ports:
      - "5000:5000"
      - "5044:5044"
    links:
      - elasticsearch

  kibana:
    build: kibana/
    container_name: kibana
    volumes:
      - ./kibana/config:/opt/kibana/config
    ports:
      - "5601:5601"

volumes:
  elasticsearch:
    driver: local

Also, I tried with:

volumes:
  elasticsearch:
    driver: local
    driver_opts:
      type: 'none'
      o: 'bind'
      device: '/myfolder/elasticsearch/storage/'

version:

docker-compose version 1.18.0, build 8dd22a9

I created the volume:

docker volume create elasticsearch

and tried deleting that /var/lib/docker/volumes/xxxxx folder and do a symlink to my volume, but didn't do it.

Is it possible? I have the volume attached to the host, there are no other things running nor older images/volumes. It will be only ELK stack with this volume with existing data in it.

Thanks

标签： dockerelastic-stack

Answer 1

由于我们无法重新索引附加卷的数据，我们决定从头开始，更新版本，构建另一个 docker-compose 文件并让 filebeat 从服务器中提取日志文件。不利的一面是，这些导入的日志从导入的日期开始计算，但在其中一个字段中有一个带有实际日期的时间戳。