下载filebeat

1
2
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.4.0-linux-x86_64.tar.gz
tar -xf filebeat-7.4.0-linux-x86_64.tar.gz

制作filebeat镜像

1
2
3
4
5
6
7
8
9
10
cat filebeat-7.4.0-linux-x86_64/dockerfile
FROM registry.cn-shanghai.aliyuncs.com/wikifx/base:alpine-glibc-Shanghai

WORKDIR /app

COPY . .

RUN chmod +x filebeat

ENTRYPOINT ["/app/filebeat", "-e", "-path.home", "./", "-path.data", "./data"]

编排文件编写

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
apiVersion: v1
kind: Namespace
metadata:
name: ops
---
apiVersion: v1
kind: ConfigMap
metadata:
name: filebeat-config
namespace: ops
labels:
k8s-app: filebeat
kubernetes.io/cluster-service: "true"
data:
filebeat.yml: |-
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/applogs/*/*.log
tags: ["k8s_applogs", "SH"]
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after
tail_files: true

filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false

setup.template.settings:
index.number_of_shards: 1

output.logstash:
hosts: ["172.19.111.144:8080"]

processors:
- add_host_metadata:
netinfo.enabled: true
cache.ttl: 5m

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
labels:
app: logscollection
name: logscollection
namespace: ops
spec:
selector:
matchLabels:
app: logscollection
template:
metadata:
labels:
app: logscollection
spec:
containers:
- args: [
"-c", "/etc/filebeat.yml"
]
image: registry.cn-shanghai.aliyuncs.com/wikifx/base:logscollection-public
name: logscollection-public
resources:
limits:
cpu: 500m
memory: 500Mi
requests:
cpu: 10m
memory: 100Mi
volumeMounts:
- name: config
mountPath: /etc/filebeat.yml
readOnly: true
subPath: filebeat.yml
- name: applogs
mountPath: /var/applogs
volumes:
- name: config
configMap:
defaultMode: 0444
name: filebeat-config
- hostPath:
path: /var/applogs
type: DirectoryOrCreate
name: applogs

安装执行

1
2
3
4
[root@node002 DaemonSet]# kubectl apply -f logscollection
namespace/ops created
configmap/filebeat-config created
daemonset.apps/logscollection created

install

result