filebeat采用sidecar模式收集k8s日志

模式收集k8s日志"/>

filebeat采用sidecar模式收集k8s日志

创建filebeat-config.yaml，注意对应namespace

apiVersion: v1
kind: ConfigMap
metadata:name: filebeat-confignamespace: prod
data:filebeat.yml: |filebeat.inputs:- type: logpaths:- /app/logs/*.logdocument_type: project_logfields:log_type: project_lognamespace: prod#空格开头的多行合并multiline.pattern: '^\['multiline.negate: truemultiline.match: afterprocessors:- add_cloud_metadata:output.kafka:hosts: ["172.16.200.20:9092","172.16.200.21:9092","172.16.200.22:9092"]  #kafka地址topic: elk   #topic名字partition.round_robin:reachable_only: falserequired_acks: 1compression: gzipmax_message_bytes: 1000000

执行apply命令

kubectl apply -f filebeat-config.yaml

修改现有各服务的deployment配置，以“myapp-api”为例

apiVersion: apps/v1
kind: Deployment
metadata:annotations:deployment.kubernetes.io/revision: "26"creationTimestamp: "2022-07-27T02:25:34Z"generation: 30labels:app: myapp-apiname: myapp-apinamespace: prodresourceVersion: "7390057"uid: f5d3c49f-f343-4145-a70d-c27d8b0b4172
spec:progressDeadlineSeconds: 600replicas: 1revisionHistoryLimit: 10selector:matchLabels:app: myapp-apistrategy:rollingUpdate:maxSurge: 25%maxUnavailable: 25%type: RollingUpdatetemplate:metadata:annotations:kubectl.kubernetes.io/restartedAt: "2022-08-11T10:30:37Z"creationTimestamp: nulllabels:app: myapp-apispec:containers:######## 新增内容 START ########- image: app.myhabor/base/filebeat:8.3.3imagePullPolicy: IfNotPresentname: filebeatresources:limits:cpu: 500mmemory: 256MisecurityContext:procMount: DefaultrunAsUser: 0terminationMessagePath: /dev/termination-logterminationMessagePolicy: FilevolumeMounts:- mountPath: /usr/share/filebeat/filebeat.ymlname: filebeat-volumesubPath: filebeat.yml- mountPath: /app/logsname: project-log######## 内容结尾 END ########- image: app.myhabor/app/myapp-api:1.0imagePullPolicy: IfNotPresentname: appresources: {}terminationMessagePath: /dev/termination-logterminationMessagePolicy: File######## 新增内容 START ########volumeMounts:- mountPath: /app/logsname: project-log######## 内容结尾 END ########dnsPolicy: ClusterFirstrestartPolicy: AlwaysschedulerName: default-schedulersecurityContext: {}terminationGracePeriodSeconds: 30######## 新增内容 START ########volumes:- configMap:defaultMode: 420items:- key: filebeat.ymlpath: filebeat.ymlname: filebeat-configname: filebeat-volume- emptyDir: {}name: project-log######## 内容结尾 END ########status:availableReplicas: 1conditions:- lastTransitionTime: "2022-07-29T09:07:53Z"lastUpdateTime: "2022-08-11T10:30:40Z"message: ReplicaSet "myapp-api-57dd44c648" has successfully progressed.reason: NewReplicaSetAvailablestatus: "True"type: Progressing- lastTransitionTime: "2022-08-18T09:57:08Z"lastUpdateTime: "2022-08-18T09:57:08Z"message: Deployment has minimum availability.reason: MinimumReplicasAvailablestatus: "True"type: AvailableobservedGeneration: 30readyReplicas: 1replicas: 1updatedReplicas: 1

修改后可以看到pod中有2个容器，本次filebeat部署完成

[root@k8s-master ~]# kubectl get pod -A|grep myapp-api
prod                 myapp-api-57dd44c648-56gjs                       2/2     Running   0             167m