K8s 部署filebeat 并收集 nginx 日志

 link: K8S 通过statefulset部署 elasticsearch 集群 v7.17.15-优快云博客

一、部署nginx服务

1.nginx配置文件

[root@k8s-master nginx]# cat nginx.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
data:
  nginx.conf: |-
    error_log  /usr/share/nginx/logs/error.log;
    worker_processes  1;
    events {
        worker_connections  1024;
    }
    http {
        include       mime.types;
        default_type  application/octet-stream;

        log_format log_json '{"@timestamp": "$time_local", '
                            '"remote_addr": "$remote_addr", '
                            '"referer": "$http_referer", '
                            '"request": "$request", '
                            '"status": $status, '
                            '"bytes": $body_bytes_sent, '
                            '"agent": "$http_user_agent", '
                            '"x_forwarded": "$http_x_forwarded_for", '
                            '"up_addr": "$upstream_addr",'
                            '"up_host": "$upstream_http_host",'
                            '"up_resp_time": "$upstream_response_time",'
                            '"request_time": "$request_time"'
                            ' }';
        access_log  /usr/share/nginx/logs/access.log  log_json;

        sendfile        on;
        keepalive_timeout  65;
        server {
            listen       80;
            server_name  localhost;
            location / {
                root   html;
                index  index.html index.htm;
            }

            error_page   500 502 503 504  /50x.html;
            location = /50x.html {
                root   html;
            }
        }
    }

2.nginx deployment文件

[root@k8s-master nginx]# cat nginx-deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx

    spec:
      affinity:                                        # 设置nginx pod分开调度到一起
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - store
            topologyKey: "kubernetes.io/hostname"
      containers:
        - name: nginx
          image: 192.168.178.137/elastic/nginx:v1
          imagePullPolicy: IfNotPresent
          volumeMounts:                                                            #定义存储卷挂载
            - name: nginx-config                                                  #挂载卷的名称
              mountPath: /etc/nginx/nginx.conf                    # 挂载到容器的指定路径
              subPath: nginx.conf
            - name: nginx-logs                                     # 本地挂载
              mountPath: /usr/share/nginx/logs                     # 挂载到容器的指定路径
            - name: html
              mountPath: /usr/share/nginx/html
            #- name: logs
            #  mountPath: /usr/share/nginx/logs


      volumes:                               # 定义存储卷
        - name: nginx-config                   # 定义存储卷的名称
          configMap:                           # 存储卷的类型为configMap
            name: nginx-config                 # 指定的configMap名称
        #- name: nginx-logs
        #  persistentVolumeClaim:
        #    claimName: nginx-pvc
        - name: html
          hostPath:
            path: /nfs/nginx/html
        - name: nginx-logs
          hostPath:
            path: /data/nginx

3. nginx svc

[root@k8s-master nginx]# cat nginx-svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: nginx-service  #定义service名称为nginx-service
  labels:
    app: nginx-service   #为service打上app标签
spec:
  type: NodePort   #使用NodePort方式开通，在每个Node上分配一个端口作为外部访问入口
  selector:
    app: nginx
  ports:
  - port: 8000  #port是k8s集群内部访问service的端口，即通过clusterIP: port可以访问到某个service
    targetPort: 80  #targetPort是pod的端口，从port和nodePort来的流量经过kube-proxy流入到后端pod的targetPort上，最后进入容器
    nodePort: 30003  #nodePort是外部访问k8s集群中service的端口，通过nodeIP: nodePort可以从外部访问到某个service

二、部署filebeat

1、filebeat的配置文件

[root@k8s-master filebeat]# cat filebeat.yml
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: elk-ns
data:
  filebeat.yml: |-
    filebeat.inputs:
    - type: log
      enabled: true
      paths:
        - /usr/local/nginx/logs/access.log
      json.keys_under_root: true
      json.add_error_key: true
      json.message_key: log
      tags: ["nginx-access"]

    - type: log
      enabled: true
      paths:
        - /usr/local/nginx/logs/error.log
      tags: ["nginx-error"]

    output.elasticsearch:
      hosts: ["http://192.168.178.129:30001","http://192.168.178.130:30001","http://192.168.178.131:30001"]
      indices:
        - index: "nginx-access-%{+yyyy.MM.dd}"
          when.contains:
            tags: "nginx-access"
        - index: "nginx-error-%{+yyyy.MM.dd}"
          when.contains:
            tags: "nginx-error"
    setup.template.name: "nginx"
    setup.template.pattern: "nginx-*"
    setup.template.enabled: false
    setup.template.overwrite: true
    setup.ilm.enabled: false

2、daemonset部署filebeat 

[root@k8s-master filebeat]# cat filebeat-ds.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: filebeat-cluster
  namespace: elk-ns
  labels:
    k8s-app: filebeat-cluster
    version: v7.17.15
spec:
  selector:
    matchLabels:
      k8s-app: filebeat-cluster  # 这个需要与template保持一致
      version: v7.17.15
  template:
    metadata:
      labels:
        k8s-app: filebeat-cluster
        version: v7.17.15
    spec:
      containers:
      - name: filebeat-cluster
        image: 192.168.178.137/elastic/filebeat:7.17.15

        volumeMounts:                #定义存储卷挂载，这里主要是将主容器挂载的存储首先挂载到初始化容器，权限调整后，主容器方可使用
          - name: filebeat-config
            mountPath: /usr/share/filebeat/filebeat.yml
            subPath: filebeat.yml
          - name: nginx-logs
            mountPath: /data/nginx/
      volumes:                                                  #定义存储卷
        - name: filebeat-config                   #定义存储卷的名称
          configMap:                         #存储卷的类型为configMap
            name: filebeat-config                 #指定的configMap名称
        - name: nginx-logs
          hostPath:
            path: /data/nginx