在k8s集群中搭建elasticsearch+kibana+flentd日志系统-Toy模板网

这篇具有很好参考价值的文章主要介绍了在k8s集群中搭建elasticsearch+kibana+flentd日志系统。希望对大家有所帮助。如果存在错误或未考虑完全的地方，请大家不吝赐教，您也可以点击"举报违法"按钮提交疑问。

如何在k8s中搭建efk收集集群日志

在离线环境部署一套日志采集系统我采用的是elasticsearch+kibana+flentd日志系统

首先跟大部分网友一样创建ns,es的无头服务

yaml文件如下：
apiVersion: v1
kind: Namespace
metadata:
name: logging

kind: Service
apiVersion: v1
metadata:
name: elasticsearch
namespace: logging
labels:
app: elasticsearch
spec:
selector:
app: elasticsearch
clusterIP: None
ports:
- port: 9200
name: rest
- port: 9300
name: inter-node

2.部署es集群

apiVersion: apps/v1 kind: StatefulSet metadata: name: es namespace: logging spec: serviceName: elasticsearch replicas: 3 selector: matchLabels: app: elasticsearch template: metadata: labels: app: elasticsearch spec: nodeSelector: es: log initContainers: - name: increase-vm-max-map image: busybox imagePullPolicy: “IfNotPresent” command: [“sysctl”, “-w”, “vm.max_map_count=262144”] securityContext: privileged: true - name: increase-fd-ulimit image: busybox command: [“sh”, “-c”, “ulimit -n 65536”] securityContext: privileged: true containers: - name: elasticsearch image: docker.elastic.co/elasticsearch/elasticsearch:7.17.1 imagePullPolicy: “IfNotPresent” ports: - name: rest containerPort: 9200 - name: inter containerPort: 9300 resources: limits: cpu: 1000m requests: cpu: 1000m volumeMounts: - name: data mountPath: /usr/share/elasticsearch/data env: - name: cluster.name value: k8s-logs - name: node.name valueFrom: fieldRef: fieldPath: metadata.name - name: cluster.initial_master_nodes value: “es-0,es-1,es-2” - name: discovery.zen.minimum_master_nodes value: “2” - name: discovery.seed_hosts value: “elasticsearch” - name: ES_JAVA_OPTS value: “-Xms512m -Xmx512m” - name: network.host value: “0.0.0.0” vloumes: - name: data hostpath: path: /var/app/ocr 这里我采用的是hostpath的挂载方式，因为我还没有单独划分一块磁盘出来。接下来我们可以通过es的rest接口去测试一下es集群使用下面的命令将本地端口9200 转发到 Elasticsearch 节点（如es-0）对应的端口： $ kubectl port-forward es-0 9200:9200 --namespace=logging Forwarding from 127.0.0.1:9200 -> 9200 Forwarding from [::1]:9200 -> 9200 另外开启终端执行：$ curl http://localhost:9200/_cluster/state?pretty apiVersion: v1 kind: ConfigMap metadata: namespace: logging name: kibana-config labels: app: kibana data: kibana.yml: | server.name: kibana server.host: “0.0.0.0” i18n.locale: zh-CN #设置默认语言为中文 elasticsearch: hosts: ${ELASTICSEARCH_HOSTS} #es集群连接地址，由于我这都都是k8s部署且在一个ns下，可以直接使用service name连接

apiVersion: v1
kind: Service
metadata:
name: kibana
namespace: logging
labels:
app: kibana
spec:
ports:

port: 5601
type: NodePort
selector:
app: kibana

apiVersion: apps/v1
kind: Deployment
metadata:
name: kibana
namespace: logging
labels:
app: kibana
spec:
selector:
matchLabels:
app: kibana
template:
metadata:
labels:
app: kibana
spec:
nodeSelector:
es: log
containers:
- name: kibana
image: harbor.domain.com/efk/kibana:7.17.1
imagePullPolicy: “IfNotPresent”
resources:
limits:
cpu: 1000m
requests:
cpu: 1000m
env:
- name: ELASTICSEARCH_URL
value: http://elasticsearch:9200 #设置为handless service dns地址即可
- name: ELASTICSEARCH_HOSTS
value: http://elasticsearch:9200
ports:
- containerPort: 5601
这里我依旧没有挂载配置文件，通过nortport端口访问正常能打开

3.以上我是直接参考的其他网友的操作，但是接下来如果还按照他们的配置的话，我发现自己的集群没有办法采集日志到es,浏览官网后发现，不需要自己去配置规则，官网把采集配置已经打包在镜像里面，

于是我的yaml文件只是换个镜像 apiVersion: v1 kind: ServiceAccount metadata: name: fluentd-es namespace: logging labels: k8s-app: fluentd-es kubernetes.io/cluster-service: “true” addonmanager.kubernetes.io/mode: Reconcile

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: fluentd-es
labels:
k8s-app: fluentd-es
kubernetes.io/cluster-service: “true”
addonmanager.kubernetes.io/mode: Reconcile
rules:

apiGroups:
- “”
  resources:
- “namespaces”
- “pods”
  verbs:
- “get”
- “watch”
- “list”

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: fluentd-es
labels:
k8s-app: fluentd-es
kubernetes.io/cluster-service: “true”
addonmanager.kubernetes.io/mode: Reconcile
subjects:

kind: ServiceAccount
name: fluentd-es
namespace: logging
apiGroup: “”
roleRef:
kind: ClusterRole
name: fluentd-es
apiGroup: “”

apiVersion: apps/v1
kind: DaemonSet
metadata:
name: fluentd-es
namespace: logging
labels:
k8s-app: fluentd-es
kubernetes.io/cluster-service: “true”
addonmanager.kubernetes.io/mode: Reconcile
spec:
selector:
matchLabels:
k8s-app: fluentd-es
template:
metadata:
labels:
k8s-app: fluentd-es
kubernetes.io/cluster-service: “true”
# 此注释确保如果节点被驱逐，fluentd不会被驱逐，支持关键的基于 pod 注释的优先级方案。
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ‘’
spec:
serviceAccountName: fluentd-es
containers:
- name: fluentd-es
image: harbor.domain.com/efk/fluentd:v3.4.0
imagePullPolicy: “IfNotPresent”
env:
- name: FLUENTD_ARGS
value: --no-supervisor -q
resources:
limits:
memory: 500Mi
requests:
cpu: 100m
memory: 200Mi
volumeMounts:
- name: varlog
mountPath: /var/log
- name: varlibdockercontainers
mountPath: /data/docker/containers
readOnly: true
- name: config-volume
mountPath: /etc/fluent/config.
tolerations:
- operator: Exists
terminationGracePeriodSeconds: 30
volumes:
- name: varlog
hostPath:
path: /var/log
- name: varlibdockercontainers
hostPath:
path: /var/lib/docker/containers
- name: config-volume
configMap:
name: fluentd-config
我又发现一个bug,挂载的时候mountpath 跟hostpath目录要保持一致，hostpath路径为docker本地的日志存放位置

4.测试服务

测试的时候发现日志能正常推送，调es的rest接口也能看到索引，但是正常运行二天过后就出现了日志无法发送es的问题，初步判断可能是跟新搭建的es集群有关系，还有kibana照网友安装会有安全问题，导致没办法把日志吐到es,正好我们公司有公共的es，于是我
在k8s 部署elasticsearch kibana logstash redis,elasticsearch,大数据,搜索引擎
在环境变量里面添加地址跟账号信息，发现可以正常展示日志，而且是实时的，于是改成公共的es,这样还不用我们去维护
建议：还是要以官方文档位置，每个人的环境都是不一样，不能完全照搬别人的搭建思路
参考文件：https://blog.csdn.net/qq_36200932/article/details/123166613文章来源地址https://www.toymoban.com/news/detail-564552.html