說明

Filebeat可以以sidecar模式來進行容器日誌的收集，也就是filebeat和具體的服務容器部署在同一個pod內，指定收集日誌的路徑或檔案，即可將日誌傳送到指定位置或Elasticsearch這類的搜尋引擎。
每個pod內部署filebeat的模式，好處是和具體的應用服務低耦合，可擴充套件性強，不過需要在yaml進行額外配置。

yaml示例

# app服務
---
apiVersion: v1
kind: Service
metadata:
  name: test-app
  labels:
    app: test-app
spec:
  selector
 
:
    app: test-app
  ports:
  - protocol: TCP
    port: 8080
    targetPort: 8080
    name: test-port
#定義日誌收集相關配置的一個configmap
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: test-filebeat-config
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.prospectors:
    - type: log
      paths
 
:
        - /logdata/*.log
      tail_files: true
      fields:
        pod_name: '${pod_name}'
        POD_IP: '${POD_IP}'
    setup.template.name: "app-logs"
    setup.template.pattern: "app-logs-*"
    output.elasticsearch: # 日誌輸出到ES
      hosts: ["192.168.1.xx:9200","192.168.1.xxx:9200"]
      index: "app-logs-%{+yyyy.MM}"
 

# deployment, 也可通過daemonset方式
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-app
spec:
  replicas: 1
  minReadySeconds: 15     #滾動升級15s後標誌pod準備就緒
  strategy:
    rollingUpdate:        #replicas為2, 升級過程中pod個數在1-3個之間
      maxSurge: 1         #滾動升級時會先啟動1個pod
      maxUnavailable: 1   #滾動升級時允許pod處於Unavailable的最大個數
  selector:
    matchLabels:
      app: test-app
  template:
    metadata:
      labels:
        app: test-app
    spec:
      terminationGracePeriodSeconds: 30 #30秒內優雅關閉程式
      containers:
      - image: hub.exmaple.com/publib/filebeat:6.1.3     #提前下載下來到私有映象庫的映象(官方的可能會被牆)
        name: filebeat
        args: [
          "-c", "/opt/filebeat/filebeat.yml",
          "-e",
        ]
        env:
        - name: POD_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: pod_name
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        securityContext:
          runAsUser: 0
        resources:
          limits:
            memory: 200Mi
          requests:
            cpu: 200m
            memory: 200Mi
        volumeMounts:
        - name: config               #將configmap的內容放到容器本地目錄
          mountPath: /opt/filebeat/
        - name: data
          mountPath: /usr/share/filebeat/data
        - name: logdata       #同一個pod內的兩個應用共享目錄logdata, 一個寫一個讀
          mountPath: /logdata
      - name: test-app
        image: hub.example.com/service/test-service:latest  #提供具體服務的app映象
        ports:
        - containerPort: 8080
        volumeMounts:
        - name: logdata       #指定掛在目錄到logdata
          mountPath: /usr/local/tomcat/logs
      volumes:
      - name: data
        emptyDir: {}
      - name: logdata         #定義logdata為EmptyDir型別掛載目錄
        emptyDir: {}
      - name: config
        configMap:
          name: test-filebeat-config  #使用前面定義的configmap
          items:
          - key: filebeat.yml
            path: filebeat.yml

檢視filebeat和app的執行日誌

kubectl logs -f <pod名> filebeat
kubectl logs -f <pod名> test-app

這時可看到詳細的執行日誌情況，同時elasticsearch上也會新建一個app-logs-xxxx.xx的索引。