helm 安装EFK(Elasticsearch+Filebeat+Kibana)收集容器日志

官方地址：https://github.com/elastic/helm-charts

我用的是helm3安装

1.安装elasticsearch

kubectl create ns logs
helm repo add elastic https://helm.elastic.co
helm pull elastic/elasticsearch
tar zxf elasticsearch-7.6.0.tgz
cd elasticsearch

编辑values.yaml文件
vim values.yaml:
---
volumeClaimTemplate:
  accessModes: [ "ReadWriteOnce" ]
  storageClassName: alicloud-nas
  resources:
    requests:
      storage: 30Gi
nfs:
  server: 35d034b182-lhi55.cn-shanghai.nas.aliyuncs.com
---

持久化存储，

用的是阿里云的nas存储，用自建的nfs也可以。

1） 在nas根目录下创建下面目录：

mkdir elasticsearch-logging/{0,1,2}

2）在chart下面的templates目录下加一个一个pv-pvc.yaml文件

cat pv-pvc.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
    name: elastic-nas-pv-0
    labels:
      release: elastic-nas-pv
spec:
    capacity:
      storage: 60Gi
    accessModes:
      - ReadWriteOnce
    volumeMode: Filesystem
    persistentVolumeReclaimPolicy: Retain
    storageClassName: "{{ .Values.volumeClaimTemplate.storageClassName }}"
    nfs:
      path: /elasticsearch-logging/0
      server: "{{ .Values.nfs.server }}" 
---
apiVersion: v1
kind: PersistentVolume
metadata:
    name: elastic-nas-pv-1
    labels:
      release: elastic-nas-pv
spec:
    capacity:
      storage: 60Gi
    accessModes:
      - ReadWriteOnce
    volumeMode: Filesystem
    persistentVolumeReclaimPolicy: Retain
    storageClassName: "{{ .Values.volumeClaimTemplate.storageClassName }}"
    nfs:
      path: /elasticsearch-logging/1
      server: "{{ .Values.nfs.server }}" 
---
apiVersion: v1
kind: PersistentVolume
metadata:
    name: elastic-nas-pv-2
    labels:
      release: elastic-nas-pv
spec:
    capacity:
      storage: 60Gi
    accessModes:
      - ReadWriteOnce
    volumeMode: Filesystem
    persistentVolumeReclaimPolicy: Retain
    storageClassName: "{{ .Values.volumeClaimTemplate.storageClassName }}"
    nfs:
      path: /elasticsearch-logging/2
      server: "{{ .Values.nfs.server }}"

之后，helm安装

helm install elasticsearch -n logs ./elasticsearch

查看状态

2. 安装kibana

helm pull elastic/kibana
tar zxf kibana-7.6.0.tgz 
cd kibana

编辑values.yaml文件

ingress:
  enabled: true  #改成true。也可以不用ingress,用nodeport方式访问
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  path: /
  hosts:
    - kibana.xxoo.com  #改成自己的域名
  tls: []   #有证书也改成自己的创建的证书名，我这边没有创建
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

安装kibana

helm install kibana -n logs ./kibana

查看运行的pod

3. 安装filebeat

helm pull elastic/filebeat
tar zxf filebeat-7.6.0.tgz
cd filebeat

编辑values.yaml文件

#默认读取的是节点/var/lib下的所有文件
# Root directory where Filebeat will write data to in order to persist registry data across pod restarts (file position and other metadata).
hostPathRoot: /var/lib

安装

helm install filebeat -n logs ./filebeat

查看：

4.使用

打开kibana的域名，登陆kibana。创建索引。

筛选pod，查看日志