K8s 上一鍵安裝 EFK
EFK
Elasticsearch,Fluentd,Kibana 的組合 Teck stack
- Elasticsearch 用於儲存與搜尋
- Fluentd 用於收集系統 Log
- Kibana 提供資料視覺化
開始安裝
把下列內容儲存成 template.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
| ---
apiVersion: v1
kind: Service
metadata:
name: elasticsearch-kibana
labels:
app: elasticsearch-kibana
spec:
type: ClusterIP
selector:
app: elasticsearch-kibana
ports:
- name: es-port
protocol: TCP
port: 9200
targetPort: 9200
- name: kibana-port
protocol: TCP
port: 5601
targetPort: 5601
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: elasticsearch-kibana
labels:
app: elasticsearch-kibana
spec:
replicas: 1
selector:
matchLabels:
app: elasticsearch-kibana
template:
metadata:
labels:
app: elasticsearch-kibana
spec:
containers:
- name: elasticsearch-kibana
image: nshou/elasticsearch-kibana:kibana7
imagePullPolicy: IfNotPresent
securityContext:
privileged: true
ports:
- name: es-port
protocol: TCP
containerPort: 9200
- name: kibana-port
protocol: TCP
containerPort: 5601
env:
- name: "SSL_MODE"
value: "false"
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: fluent-bit
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: fluent-bit-read
rules:
- apiGroups:
- ""
resources:
- "nodes"
- "events"
- "namespaces"
- "pods"
verbs:
- "get"
- "list"
- "watch"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: fluent-bit-read
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: fluent-bit-read
subjects:
- kind: ServiceAccount
name: fluent-bit
namespace: aio
---
apiVersion: v1
kind: ConfigMap
metadata:
name: fluent-bit-cm
data:
fluent-bit.conf: |-
[SERVICE]
Flush 1
Log_Level info
Parsers_File parsers.conf
@INCLUDE input-cpu.conf
@INCLUDE input-mem.conf
@INCLUDE input-k8s.conf
@INCLUDE input-disk.conf
@INCLUDE input-network.conf
@INCLUDE filter-k8s.conf
@INCLUDE output-elasticsearch.conf
parsers.conf: |-
[PARSER]
Name cri
Format regex
Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<log>.*)$
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L%z
input-cpu.conf: |
[INPUT]
Name cpu
Tag cpu
input-mem.conf: |
[INPUT]
Name mem
Tag memory
input-disk.conf: |
[INPUT]
Name disk
Tag disk
Interval_Sec 1
Interval_NSec 0
input-network.conf: |
[INPUT]
Name netif
Tag netif
Interval_Sec 1
Interval_NSec 0
Interface eth0
input-k8s.conf: |
[INPUT]
Name tail
Tag kube.*
Path /var/log/containers/*_default_*.log
Parser cri
DB /var/log/fluentbit.db
Mem_Buf_Limit 5MB
Skip_Long_Lines on
Refresh_Interval 10
filter-k8s.conf: |
[FILTER]
Name kubernetes
Match kube.*
Kube_URL https://kubernetes.default.svc:443
Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token
Kube_Tag_Prefix kube.var.log.containers.
Merge_Log on
Merge_Log_Key log_processed
K8S-Logging.Parser off
K8S-Logging.Exclude off
output-elasticsearch.conf: |
[OUTPUT]
Name es
Match *
Host elasticsearch-kibana
Port 9200
Type _doc
Logstash_Format on
Logstash_Prefix project
Logstash_DateFormat %Y.%m.%d
Time_Key_Format %Y-%m-%dT%H:%M:%S
Buffer_Size 16k
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: fluent-bit
labels:
app: fluent-bit
spec:
selector:
matchLabels:
app: fluent-bit
template:
metadata:
labels:
app: fluent-bit
spec:
volumes:
- name: log
hostPath:
path: /var/log
type: Directory
- name: config
configMap:
name: fluent-bit-cm
containers:
- name: fluent-bit
image: fluent/fluent-bit:1.7.0
imagePullPolicy: IfNotPresent
ports:
- name: http-port
protocol: TCP
containerPort: 2020
volumeMounts:
- name: log
mountPath: /var/log
- name: config
mountPath: /fluent-bit/etc
terminationGracePeriodSeconds: 10
serviceAccountName: fluent-bit
tolerations:
- key: node-role.kubernetes.io/master
operator: "Exists"
effect: "NoSchedule"
- operator: "Exists"
effect: "NoExecute"
- operator: "Exists"
effect: "NoSchedule"
|
1
| kubectl apply -f template.yaml #套用至 K8s
|
