k8s fluentbit收集所有容器标准输出的日志

k8s-fluentbit收集所有容器标准输出的日志

1. fluentbit收集所有容器标准输出的日志

• 编写fluentbit日志收集yaml配置文件

  ---
  # fluentbit的配置文件
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: fluent-bit-config
    namespace: efk
    labels:
      k8s-app: fluent-bit
  data:
    # Configuration files: server, input, filters and output
    # ======================================================
    fluent-bit.conf: |
      [SERVICE]
          Flush         1
          Log_Level     info
          Daemon        off
          Parsers_File  parsers.conf
          HTTP_Server   On
          HTTP_Listen   0.0.0.0
          HTTP_Port     2020
  
      @INCLUDE input-kubernetes.conf
      @INCLUDE filter-kubernetes.conf
      @INCLUDE output-elasticsearch.conf
  
    input-kubernetes.conf: |
      [INPUT]
          Name              tail
          Tag               kube.*
          Path              /var/log/containers/*.log
          Parser            docker
          DB                /var/log/flb_kube.db
          Mem_Buf_Limit     5MB
          Skip_Long_Lines   On
          Refresh_Interval  10
  
    filter-kubernetes.conf: |
      [FILTER]
          Name                kubernetes
          Match               kube.*
          Kube_URL            https://kubernetes.default.svc:443
          Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
          Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
          Kube_Tag_Prefix     kube.var.log.containers.
          Merge_Log           On
          Merge_Log_Key       log_processed
          K8S-Logging.Parser  On
          K8S-Logging.Exclude Off
  
    output-elasticsearch.conf: |
      [OUTPUT]
          Name            es
          Match           *
          Host            ${FLUENT_ELASTICSEARCH_HOST}
          Port            ${FLUENT_ELASTICSEARCH_PORT}
          HTTP_User elastic
          HTTP_Passwd 9YbX73x8q1Go2USZxJhj
          Logstash_Prefix kubernetes
          Logstash_DateFormat %Y.%m.%d
          Logstash_Format On
          Replace_Dots    On
          Retry_Limit     False
  
    parsers.conf: |
      [PARSER]
          Name   apache
          Format regex
          Regex  ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
          Time_Key time
          Time_Format %d/%b/%Y:%H:%M:%S %z
  
      [PARSER]
          Name   apache2
          Format regex
          Regex  ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
          Time_Key time
          Time_Format %d/%b/%Y:%H:%M:%S %z
  
      [PARSER]
          Name   apache_error
          Format regex
          Regex  ^\[[^ ]* (?<time>[^\]]*)\] \[(?<level>[^\]]*)\](?: \[pid (?<pid>[^\]]*)\])?( \[client (?<client>[^\]]*)\])? (?<message>.*)$
  
      [PARSER]
          Name   nginx
          Format regex
          Regex ^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
          Time_Key time
          Time_Format %d/%b/%Y:%H:%M:%S %z
  
      [PARSER]
          Name   json
          Format json
          Time_Key time
          Time_Format %d/%b/%Y:%H:%M:%S %z
  
      [PARSER]
          Name        docker
          Format      json
          Time_Key    time
          Time_Format %Y-%m-%dT%H:%M:%S.%L
          Time_Keep   On
  
      [PARSER]
          # http://rubular.com/r/tjUt3Awgg4
          Name cri
          Format regex
          Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
          Time_Key    time
          Time_Format %Y-%m-%dT%H:%M:%S.%L%z
  
      [PARSER]
          Name        syslog
          Format      regex
          Regex       ^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$
          Time_Key    time
          Time_Format %b %d %H:%M:%S
  ---
  # 配置fluentbit 角色权限
  apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: ClusterRoleBinding
  metadata:
    name: fluent-bit-read
    namespace: efk
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: fluent-bit-read
  subjects:
  - kind: ServiceAccount
    name: fluent-bit
    namespace: logging
  
  
  ---
  # 配置fluentbit 角色权限
  apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: ClusterRole
  metadata:
    name: fluent-bit-read
    namespace: efk
  rules:
  - apiGroups: [""]
    resources:
    - namespaces
    - pods
    verbs: ["get", "list", "watch"]
  
  
  ---
  # fluent-bit-service-account 配置
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: fluent-bit
    namespace: efk
  
  
  
  ---
  # fluent-bit daemonset 部署收集日志
  apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    name: fluent-bit
    namespace: efk
    labels:
      k8s-app: fluent-bit-logging
      version: v1
      kubernetes.io/cluster-service: "true"
  spec:
    selector:
      matchLabels:
        k8s-app: fluent-bit-logging
    template:
      metadata:
        labels:
          k8s-app: fluent-bit-logging
          version: v1
          kubernetes.io/cluster-service: "true"
        annotations:
          prometheus.io/scrape: "true"
          prometheus.io/port: "2020"
          prometheus.io/path: /api/v1/metrics/prometheus
      spec:
        containers:
        - name: fluent-bit
          image: fluent/fluent-bit:1.5
          imagePullPolicy: Always
          ports:
            - containerPort: 2020
          env:
          - name: FLUENT_ELASTICSEARCH_HOST
            # 这里要填写连接的es的IP
            value: "49.65.125.91"
          - name: FLUENT_ELASTICSEARCH_PORT
            value: "9200"
          resources:
            limits:
              memory: 200Mi
            requests:
              cpu: 100m
              memory: 100Mi
          volumeMounts:
          - name: varlog
            mountPath: /var/log
          - name: varlibdockercontainers
            mountPath: /var/lib/docker/containers
            readOnly: true
          - name: fluent-bit-config
            mountPath: /fluent-bit/etc/
        terminationGracePeriodSeconds: 10
        volumes:
        - name: varlog
          hostPath:
            path: /var/log
        - name: varlibdockercontainers
          hostPath:
            path: /var/lib/docker/containers
        - name: fluent-bit-config
          configMap:
            name: fluent-bit-config
        serviceAccountName: fluent-bit
        tolerations:
        - key: node-role.kubernetes.io/master
          operator: Exists
          effect: NoSchedule
        - operator: "Exists"
          effect: "NoExecute"
        - operator: "Exists"
          effect: "NoSchedule"
  

• 创建namespace空间

  [root@k8s-master efk]# kubectl create namespace efk
  namespace/efk created
  

• 启动配置文件

  [root@k8s-master efk]# kubectl apply -f fluentbit-kubernetes.yaml 
  configmap/fluent-bit-config created
  Warning: rbac.authorization.k8s.io/v1beta1 ClusterRoleBinding is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRoleBinding
  clusterrolebinding.rbac.authorization.k8s.io/fluent-bit-read unchanged
  Warning: rbac.authorization.k8s.io/v1beta1 ClusterRole is deprecated in v1.17+, unavailable in v1.22+; use rbac.authorization.k8s.io/v1 ClusterRole
  clusterrole.rbac.authorization.k8s.io/fluent-bit-read unchanged
  serviceaccount/fluent-bit created
  daemonset.apps/fluent-bit created
  

• kibana查看es索引是否创建
  

  我们发现已经创建索引，有了数据

• 我们创建索引看看
  
  
  
  
  

• 浏览器查看创建索引