[kubernetes]-filebeat以sidecar模式收集pod日志

目的: 收集测试环境日志到kibana

定义日志收集相关配置的一个通配configmap

test-filebeat-config.yaml

#定义日志收集相关配置的一个通配configmap
---
apiVersion: v1
kind: ConfigMap
metadata:name: test-filebeat-confignamespace: testlabels:config: test-filebeat-config
data:filebeat.yml: |-filebeat.prospectors:- type: logpaths:- /data/tomcat-haozhuo-ec/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","ec"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-ec/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","ec"]- type: logpaths:- /data/tomcat-haozhuo-basic/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","basic"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-basic/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","basic"]- type: logpaths:- /data/tomcat-haozhuo-deep/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","deep"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-deep/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","deep"]- type: logpaths:- /data/tomcat-haozhuo-video/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","video"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-video/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","video"]- type: logpaths:- /data/tomcat-haozhuo-wx/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","wx"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-wx/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","wx"]- type: logpaths:- /data/tomcat-haozhuo-system/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","system"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-system/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","system"]- type: logpaths:- /data/tomcat-haozhuo-shoppingmall/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","shoppingmall"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-shoppingmall/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","shoppingmall"]- type: logpaths:- /data/tomcat-haozhuo-reportContent/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","reportContent"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-reportContent/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","reportContent"]- type: logpaths:- /data/tomcat-haozhuo-point/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","point"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-point/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","point"]- type: logpaths:- /data/tomcat-haozhuo-openapi/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","openapi"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-openapi/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","openapi"]- type: logpaths:- /data/tomcat-haozhuo-job/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","job"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-job/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","job"]- type: logpaths:- /data/tomcat-haozhuo-info/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","info"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-info/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","info"]- type: logpaths:- /data/tomcat-haozhuo-hm/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","hm"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-hm/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","hm"]- type: logpaths:- /data/tomcat-haozhuo-health/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","health"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-health/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","health"]- type: logpaths:- /data/tomcat-haozhuo-family/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","family"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-family/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","family"]- type: logpaths:- /data/tomcat-haozhuo-disc/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","disc"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-disc/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","disc"]- type: logpaths:- /data/tomcat-haozhuo-check/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","check"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-check/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","check"]- type: logpaths:- /data/tomcat-haozhuo-card/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","card"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-card/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","card"]- type: logpaths:- /data/tomcat-haozhuo-appServer/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","appServer"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-appServer/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","appServer"]- type: logpaths:- /data/tomcat-haozhuo-admin/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","admin"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-admin/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","admin"]- type: logpaths:- /data/tomcat-haozhuo-account/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","account"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-account/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","account"]- type: logpaths:- /data/tomcat-haozhuo-hmp/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","hmp"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-hmp/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","hmp"]- type: logpaths:- /data/tomcat-haozhuo-search/json.info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","search"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-search/json.error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","search"]- type: logpaths:- /data/tomcat-haozhuo-service_center/info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","service_center"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-service_center/error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","service_center"]- type: logpaths:- /data/tomcat-haozhuo-appoint_center/info.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["info","appoint_center"]- type: logenabled: truepaths:- /data/tomcat-haozhuo-appoint_center/error.*.logjson.keys_under_root: truejson.overwrite_keys: truetags: ["error","appoint_center"]filebeat.config.modules:path: ${path.config}/modules.d/*.ymlreload.enabled: falsesetup.template.enabled: falsesetup.template.settings:index.number_of_shards: 3setup.template.name: "filebeat"setup.template.fields: "fields.yml"setup.template.overwrite: falsesetup.kibana:output.elasticsearch:hosts: ["192.168.1.165:9200"]index: "jsonlog-%{+yyyy.MM.dd}"

创建一个statefulset部署应用服务。filebeat以sidecar形式一起部署 StatefulSet.yaml

apiVersion: apps/v1
kind: StatefulSet
metadata:
# deployment名字 和svc 和ingress绑定没关系name: haozhuo-account-dpnamespace: test
spec:serviceName: haozhuo-accountreplicas: 1# 在定义模板的时候必须定义labels,因为Deployment.spec.selector是必须字段,而他又必须和template.labels对应selector:matchLabels:app: haozhuo-account# template里面定义的内容会应用到下面所有的副本集里面(例如depolyment下的pod),在template.spec.containers里面不能定义labels标签。可以kubectl get pods --show-labels查看template:metadata:labels:app: haozhuo-accountenv: testspec:containers:
# 20200822- image: registry.cn-shanghai.aliyuncs.com/yjk-datag/filebeat:6     # 提前下载下来到私有镜像库的镜像(官方的可能会被墙)name: filebeatargs: ["-c", "/srv/filebeat/filebeat.yml","-e",]env:- name: POD_IPvalueFrom:fieldRef:apiVersion: v1fieldPath: status.podIP- name: pod_namevalueFrom:fieldRef:apiVersion: v1fieldPath: metadata.name- name: POD_IPvalueFrom:fieldRef:apiVersion: v1fieldPath: status.podIP- name: pod_namevalueFrom:fieldRef:apiVersion: v1fieldPath: metadata.name# securityContext:#   runAsUser: 0resources:limits:memory: 200Mirequests:cpu: 200mmemory: 200MivolumeMounts:- name: config               # 将configmap的内容放到容器本地目录mountPath: /srv/filebeat/- name: datamountPath: /usr/share/filebeat/data- name: logdata       # 同一个pod内的两个应用共享目录logdata, 一个写一个读mountPath: /data/tomcat-haozhuo-account/# 20200822# containers名字 和svc 和ingress绑定没关系- name: haozhuo-accountimage: registry.cn-shanghai.aliyuncs.com/yjk-datag/k8s-haozhuo-account:v28#image: registry.cn-shanghai.aliyuncs.com/yjk-datag/haozhuo-video:vtest06env:- name: DUBBO_IP_TO_REGISTRYvalueFrom:fieldRef:fieldPath: status.hostIP- name: DUBBO_PORT_TO_REGISTRYvalue: "20901"resources:limits:cpu: 2000mmemory: 2048Mirequests:cpu: 1000mmemory: 1024Miports:- name: jacoco-portcontainerPort: 6309- name: liveness-portcontainerPort: 8080
# 使用了 hostPort 的容器只能调度到端口不冲突的 Node 上，除非有必要（比如运行一些系统级的 daemon 服务），不建议使用端口映射功能。
# 跟 hostPort 一样的原因，避免使用 hostNetwork。
#   hostPorts:
#   - min: 8000
#     max: 8080hostPort: 8801- name: readiness-portcontainerPort: 20901hostPort: 20901
# 后续需要jacoco端口也暴露一下livenessProbe:tcpSocket:port: liveness-portinitialDelaySeconds: 20periodSeconds: 3readinessProbe:tcpSocket:port: readiness-portinitialDelaySeconds: 30periodSeconds: 10# 20200822volumeMounts:- name: logdata       # 指定挂在目录到logdata 同一个pod内的两个应用共享目录logdata, 一个写一个读# 我这里要挂载应用容器haozhuo-account中/srv/tomcat/tomcat-haozhuo-account/yjklogs/里面的*.log到filebeat容器的/data/tomcat-haozhuo-account/下mountPath: /srv/tomcat/tomcat-haozhuo-account/yjklogs/volumes:- name: dataemptyDir: {}- name: logdata         #定义logdata为EmptyDir类型挂载目录emptyDir: {}- name: configconfigMap:name: test-filebeat-config  #使用前面定义的configmapitems:- key: filebeat.ymlpath: filebeat.yml# 20200822imagePullSecrets:- name: aliyun-ns-test

导入并上传镜像

docker load < filebeat6.tar.gzdocker tag prima/filebeat:6 registry.cn-shanghai.aliyuncs.com/yjk-datag/filebeat:6docker push registry.cn-shanghai.aliyuncs.com/yjk-datag/filebeat:6

应用yaml

kubectl apply -f StatefulSet.yaml

等到容器启动完成

进入容器需要 -c 指定容器name

# 进入应用容器
kubectl exec -it haozhuo-account-dp-0   -c haozhuo-account  /bin/bash -n test
# 进入filebeat容器
kubectl exec -it haozhuo-account-dp-0   -c filebeat  /bin/bash -n test# 如果不使用-c的话会进入sidecar容器

手动输出error到error日志或者info日志

echo '{"@timestamp":"2020-08-22T15:59:10.014+08:00","@version":1,"message":"请求url:http://192.168.1.164:8030/dingtalk/order/saveOrderDataRecord 入参:","logger_name":"com.haozhuo.common.sys.http.HttpRequest","thread_name":"account-updateOrderBizData_Worker-1","level":"INFO","level_value":20000,"HOSTNAME":"haozhuo-account-dp-0.haozhuo-account.test.svc.cluster.local","tid":"6494f345-b18e-40ac-b4fc-baf851cab191"} ' >> /data/tomcat-haozhuo-account/json.info.2020-08-22.log

观察filebeat 发现采集成功

kubectl logs -f  haozhuo-account-dp-0  filebeat -n test
kubectl logs -f  haozhuo-account-dp-0  haozhuo-account -n test

[kubernetes]-filebeat以sidecar模式收集pod日志相关推荐

K8S 使用 SideCar 模式部署 Filebeat 收集容器日志
推荐阅读 Helm3(K8S 资源对象管理工具)视频教程:https://edu.csdn.net/course/detail/32506 Helm3(K8S 资源对象管理工具)博客专栏:https: ...
Kubernetes日志采集Sidecar模式介绍
摘要: DaemonSet和Sidecar模式各有优缺点,目前没有哪种方式可以适用于所有场景.因此我们阿里云日志服务同时支持了DaemonSet以及Sidecar两种方式,并对每种方式进行了一些额外的 ...
K8S使用filebeat统一收集应用日志
今年3月份在公司的内部k8s培训会上,开发同事对应用整合进pod提出了几个问题,主要围绕在java应用的日志统一收集.集中存放和java jvm内存监控数据收集相关的点上,本文将介绍使用filebea ...
filebeat+logstash收集错误日志发送邮件提醒
filebeat+logstash收集错误日志发送邮件提醒典型ELK应用架构因为只收集错误日志并且数据量并不是非常大所以简化流程使用filebeat+logstash发送异常日志软件版本说 ...
filebeat收集java日志_filebeat采集多个项目日志 | 吴老二
filebeat采集的日志内容包含java项目的和nginx日志,前期规划不同服务的日志路径应该进行区分.我们这里没有区分,java项目的日志和nginx的日志都存在一个路径下,导致在收集日志的时候, ...
Filebeat 使用 Modules 方式收集日志
01 Filebeat模块配置 Filebeat中Modules配置官方文档:官方配置文档 filebeat配置文件/etc/filebeat/filebeat.yml,配置模块路径 # ====== ...
Sidecar 模式
Sidecar 模式是 Istio 服务网格采用的模式,在服务网格出现之前该模式就一直存在,尤其是当微服务出现后开始盛行,本文讲解 Sidecar 模式. 什么是 Sidecar 模式将应用程序的功 ...
ELK日志系统之使用Rsyslog快速方便的收集Nginx日志
常规的日志收集方案中Client端都需要额外安装一个Agent来收集日志,例如logstash.filebeat等,额外的程序也就意味着环境的复杂,资源的占用,有没有一种方式是不需要额外安装程序就能实 ...
fluentd收集K8S日志并以K8S的container_name作为索引名存入Elasticsearch中
fluentd收集K8S日志并以K8S的container_name作为索引名存入Elasticsearch中参考地址 https://faun.pub/how-to-create-custom-i ...

[kubernetes]-filebeat以sidecar模式收集pod日志

[kubernetes]-filebeat以sidecar模式收集pod日志相关推荐

最新文章

热门文章