k8s&elk日志系统1

k8s日志收集采用集中式，pod日志落在node节点的/var/log/目录下，filebeat以 DaemonSet方式部署集群内部，收集数据。

1.filebeat相关配置和部署方式
在rancher中配置映射: filebeat-filebeat-config
filebeat镜像地址:ogs59/ghub:filebeat7.9.0

filebeat.config:
modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
processors:
- add_cloud_metadata:
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/*/*.log
- /var/log/messages
- /var/log/syslog
fields_under_root: true
fields:
log_topic: topic_systerm-logs
- type: log
enabled: true
paths:
- /var/lib/docker/nginxlogs/ingress/*.log
fields_under_root: true
fields:
index: "nginx-ingress-logs"
- type: docker
containers.ids:
- "*"
multiline.pattern: '^\[|^\{|^[0-9]{4}-[0-9]{2}-[0-9]{2}|^[0-9]{1,3}(\.[0-9]{1,3}){3}|^\w\d{1,4} [0-9]{2}:[0-9]{2}:[0-9]{2}.'
multiline.negate: true
multiline.match: after
multiline.max_lines: 200
multiline.timeout: 10s
fields_under_root: true
fields:
log_topic: topic_pods-logs
proces