Kubernetes 部署 ELK

Kubernetes 部署 ELK

项目背景

k8s集群搭建后，平时运维过程中不仅要观察监控平台，查看集群运行情况，还要在集群出现问题时，对问题点进行及时定位，由于集群内pod过多后，日志定位比较费时，因此一个集中式的日志文件系统成了运维人员的好帮手，本次实验采用的是filebeat+logstash+elasticsearch+kibana

组件功能描述

filebeat负责采集每个节点上宿主机和容器的日志，发送给logstash,logstash过滤不必要的信息后传递给elasticsearch进行储存，kibana展示储存在elasticsearch上的数据，并可以通过查询语句提取关键字

这里说一下为什么需要filebeat+logstash而不是单独的logstash，因为logstash中的jvm消耗的资源比较多，性能没有filebeat好，其实也可以不使用logstash，单独使用filebeat,logstash主要作用是有很多插件可以使用，并且提供过滤功能

filebeat收集数据

apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: logging

data:
  filebeat.yml: |
    filebeat.inputs:
      - type: log
        paths:
          - /var/log/nginx
        document_type: k8s-nginx

    setup.template.name: "k8s-nginx"
    setup.template.pattern: "k8s-nginx-*"
    output.elasticsearch:
      hosts: ["elasticsearch:9200"]
      index: "k8s-nginx-%{+yyyy.MM.dd}"
 #   output.logstash:
  #    hosts: ['logging-logstash:5044']
   #   enabled: true
---

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: filebeat
  namespace: logging
spec:
  selector:
    matchLabels:
      app: filebeat
  template:
    metadata:
      labels:
        k8s-app: filebeat
        app: filebeat
    spec:
      terminationGracePeriodSeconds: 30
      containers:
      - name: filebeat
        image: elastic/filebeat:7.14.0 
        imagePullPolicy: IfNotPresent 
        args: [
          "-c", "/etc/filebeat.yml",
          "-e",
        ]
        volumeMounts:
        - name: config
          mountPath: /etc/filebeat.yml
          readOnly: true
          subPath: filebeat.yml
        - name: log
          mountPath: /var/log/
      volumes:
      - name: config
        configMap:
          defaultMode: 0755
          name: filebeat-config
      - name: log
        hostPath:
          path: /var/log/
          type: Directory

logstash过滤数据

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: logstash-configmap
  namespace: logging
  labels:
    k8s-app: logstash-configmap
data:
  logstash.conf: |
      input {
        beats {
            port => "5044"
            codec => "json"
        }
      }
      filter{
        json{
                source =>  "message"
                remove_field => "message"
        }
      }
      output {
        elasticsearch {
            hosts => "elasticsearch:9200"
            index => "nginx-json-log-%{+YYYY.MM.dd}"
        }
      }
---
apiVersion: apps/v1 
kind: Deployment
metadata:
  name: logstash
  namespace: logging
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: logstash
  template:
    metadata:
      labels:
        k8s-app: logstash
    spec:
      containers:
      - name: logstash
        image: logstash:7.14.0 
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 5044
        volumeMounts:
          - name: config-volume
            mountPath: /usr/share/logstash/pipeline/
      volumes:
      - name: config-volume
        configMap:
          name: logstash-configmap
          items:
            - key: logstash.conf
              path: logstash.conf
---
apiVersion: v1
kind: Service
metadata:
  name: logstash
  namespace: logging
spec:
  ports:
  - port: 5044
    targetPort: 5044
    protocol: TCP
  selector:
    k8s-app: logstash
  type: ClusterIP

es存储数据

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv
  namespace: logging
spec:
  capacity:                             # PV的存储容量
    storage: 1Gi
  accessModes:                  # PV的访问模式
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-storage
  nfs:
    path: /data
    server: 192.168.206.135


apiVersion: v1
kind: Service
metadata:
  name: elasticsearch
  namespace: logging
  labels:
    app: elasticsearch
spec:
  selector:
    k8s-app: elasticsearch
  clusterIP: None
  ports:
    - port: 9200
      name: db
    - port: 9300
      name: inter
      
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: elasticsearch
  namespace: logging
  labels:
    k8s-app: elasticsearch
spec:
  serviceName: elasticsearch
  selector:
    matchLabels:
      k8s-app: elasticsearch
  template:
    metadata:
      labels:
        k8s-app: elasticsearch
    spec:
      containers:
      - image: elasticsearch:7.14.0
        name: elasticsearch
        resources:
          limits:
            cpu: 1
            memory: 2Gi
          requests:
            cpu: 0.5
            memory: 500Mi
        env:
          - name: "discovery.type"
            value: "single-node"
          - name: ES_JAVA_OPTS
            value: "-Xms512m -Xmx2g"
        ports:
        - containerPort: 9200
          name: db
          protocol: TCP
        - name: inter
          containerPort: 9300
        volumeMounts:
        - name: elasticsearch-data
          mountPath: /usr/share/elasticsearch/data
  volumeClaimTemplates:
  - metadata:
      name: elasticsearch-data
    spec:
      storageClassName: "nfs-storage"
      accessModes: [ "ReadWriteMany" ]
      resources:
        requests:
          storage: 1Gi


# 查询es索引
curl http://elasticsearch:9200/_cat/indices?v

kibana展示数据

apiVersion: apps/v1
kind: Deployment
metadata:
  name: kibana
  namespace: logging 
  labels:
    k8s-app: kibana
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: kibana
  template:
    metadata:
      labels:
        k8s-app: kibana
    spec:
      containers:
      - name: kibana
        image: kibana:7.14.0
        resources:
          limits:
            cpu: 1
            memory: 1G
          requests:
            cpu: 0.5
            memory: 500Mi
        env:
          - name: ELASTICSEARCH_HOSTS
            value: http://elasticsearch:9200
        ports:
        - containerPort: 5601
          protocol: TCP

---
apiVersion: v1
kind: Service
metadata:
  name: kibana
  namespace: logging
spec:
  ports:
  - port: 5601
    protocol: TCP
    targetPort: 5601
    nodePort: 30000
  type: NodePort
  selector:
    k8s-app: kibana

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kibana
  namespace: logging
spec:
  rules:
  - host: "dev-1.ad2cloud.cn"
    http:
      paths:
      - path: /kibana
        pathType: Prefix
        backend:
          service:
            name: kibana
            port:
              number: 5601

参考博客地址