这里我们采取用伴生容器的形式采集java日志
tomcat日志
1、部署一个configmap用来保存filebeat配置:
[root@master yml_files]# cat filebeat-tomcat-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: filebeat-config
namespace: xian
data:
filebeat.yml: |-
filebeat.prospectors:
- type: log
paths:
- /usr/local/tomcat/logs/catalina.*
# tags: ["tomcat"]
fields:
app: www
type: tomcat-catalina
fields_under_root: true
multiline:
pattern: '^\['
negate: true
match: after
output.logstash:
hosts: ['192.168.1.26:5044']
创建:
kubectl apply -f filebeat-tomcat-configmap.yaml
检测:
kubectl get cm -n xian
kubectl describe cm filebeat-config -n xian
2、重新部署java容器,让filebeat和 java程序共享一套
[root@master yml_files]# cat java-deploy.yaml
apiVersion: apps/v1beta1
kind: Deployment
metadata:
name: tomcat-java-demo
namespace: xian
spec:
replicas: 3
selector:
matchLabels:
project: www
app: java-demo
template:
metadata:
labels:
project: www
app: java-demo
spec:
imagePullSecrets:
- name: mysecret
containers:
- name: tomcat
image: 192.168.1.39/project/tomcat-java-demo:latest
imagePullPolicy: Always
ports:
- containerPort: 8080
name: web
protocol: TCP
resources:
requests:
cpu: 0.5
memory: 1Gi
limits:
cpu: 1
memory: 2Gi
livenessProbe:
httpGet:
path: /
port: 8080
initialDelaySeconds: 60
timeoutSeconds: 20
readinessProbe:
httpGet:
path: /
port: 8080
initialDelaySeconds: 60
timeoutSeconds: 20
volumeMounts:
- name: tomcat-logs
mountPath: /usr/local/tomcat/logs
- name: filebeat
image: docker.elastic.co/beats/filebeat:6.5.4
args: [
"-c", "/etc/filebeat.yml",
"-e",
]
resources:
limits:
memory: 500Mi
requests:
cpu: 100m
memory: 100Mi
securityContext:
runAsUser: 0
volumeMounts:
- name: filebeat-config
mountPath: /etc/filebeat.yml
subPath: filebeat.yml
- name: tomcat-logs
mountPath: /usr/local/tomcat/logs
volumes:
- name: tomcat-logs
emptyDir: {}
- name: filebeat-config
configMap:
name: filebeat-config
---
apiVersion: v1
kind: Service
metadata:
name: tomcat-java-demo
namespace: xian
spec:
selector:
project: www
app: java-demo
ports:
- name: web
port: 80
targetPort: 8080
nodePort: 30003
type: NodePort
创建服务:
kubectl apply -f java-deploy.yaml
进入filebeat容器检测:
kubectl exec -it tomcat-java-demo-7795d4954f-8htgg bash -c filebeat -n xian
[root@tomcat-java-demo-7795d4954f-8htgg filebeat]# cat /etc/filebeat.yml
filebeat.prospectors:
- type: log
paths:
- /usr/local/tomcat/logs/catalina.*
# tags: ["tomcat"]
fields:
app: www
type: tomcat-catalina
fields_under_root: true
multiline:
pattern: '^\['
negate: true
match: after
output.logstash:
hosts: ['192.168.1.26:5044'][root@tomcat-java-demo-7795d4954f-8htgg filebeat]# ls /usr/local/tomcat/logs
catalina.2019-01-10.log host-manager.2019-01-10.log localhost.2019-01-10.log localhost_access_log.2019-01-10.txt manager.2019-01-10.log
filebeat容器成功共享到java日志
3、配置logstash:
[root@localhost conf.d]# cat logstash-to-es.conf
input {
beats {
port => 5044
}
}
filter {
}
output {
if [app] == "www" {
if [type] == "nginx-access" {
elasticsearch {
hosts => ["http://192.168.1.25:9200"]
index => "nginx-access-%{+YYYY.MM.dd}"
}
}
else if [type] == "nginx-error" {
elasticsearch {
hosts => ["http://192.168.1.25:9200"]
index => "nginx-error-%{+YYYY.MM.dd}"
}
}
else if [type] == "tomcat-catalina" {
elasticsearch {
hosts => ["http://192.168.1.25:9200"]
index => "tomcat-catalina-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug }
}
else if [app] == "k8s" {
if [type] == "module" {
elasticsearch {
hosts => ["http://192.168.1.25:9200"]
index => "k8s-log-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug }
}
}
}
}
启动:
/usr/share/logstash/bin/logstash -f logstash-to-es.conf
测试:
控制台会有日志打印,并且,,kibana创建索引会出数据
spring boot项目
这里我们采用redis作为缓存。并且springboot项目需要添加日志模块。我们在代码里面指定日志输出路径为。/tmp/spring.log,总体配置和上面tomcat配置一样
1、filebeat configmap配置:
[root@master yml_files]# cat filebeat-spring-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: filebeat-config
# namespace: xian
data:
filebeat.yml: |-
filebeat.prospectors:
- type: log
paths:
- /tmp/spring.log
# tags: ["tomcat"]
fields:
app: www
type: springboot
fields_under_root: true
multiline:
pattern: '^\['
negate: true
match: after
output.redis:
hosts: ["192.168.1.26"]
password: "123456"
key: "filebeat"
db: 0
datatype: list
创建配置:
kubectl apply -f filebeat-spring-configmap.yaml
2、重新编辑项目deploy文件
[root@master02 yaml_file]# cat filebeat_mon.yaml
apiVersion: apps/v1beta2
#指定的对象名称
kind: Deployment
metadata:
name: spd-deployment
namespace: default
labels:
web: spd
spec:
#副本数
replicas: 1
#选择器
selector:
#匹配标签:app: spd
matchLabels:
app: java-spd
#创建具体的pod
template:
metadata:
labels:
app: java-spd
spec:
#获取仓库镜像认证
imagePullSecrets:
- name: registry-pull-secret
containers:
- name: spd-hello
image: 192.168.1.39/project/spring-admin:201901121525_36e8572
ports:
- containerPort: 8080
volumeMounts:
- name: spring-logs
mountPath: /tmp
- name: filebeat
image: docker.elastic.co/beats/filebeat:6.5.4
args: [
"-c", "/etc/filebeat.yml",
"-e",
]
resources:
limits:
memory: 500Mi
requests:
cpu: 100m
memory: 100Mi
securityContext:
runAsUser: 0
volumeMounts:
- name: filebeat-config
mountPath: /etc/filebeat.yml
subPath: filebeat.yml
- name: spring-logs
mountPath: /tmp
volumes:
- name: spring-logs
emptyDir: {}
- name: filebeat-config
configMap:
name: filebeat-config
#---
#apiVersion: v1
#kind: Service
#metadata:
# name: spd-service
#spec:
##指定service端口类型
# type: NodePort
# ports:
## 供集群中其它container访问端口
# - port: 80
##转向后端pod中container暴露的端口
# targetPort: 8080
##对外暴露的端口
# nodePort: 8081
# selector:
# app: java-spd
创建:
kubectl apply -f filebeat_mon.yaml
3、pod正常起来后 编辑logstatsh接受文件并输出到es
[root@localhost conf.d]# cat spring.conf
input {
redis {
host => "127.0.0.1"
port => 6379
password => "123456"
db => "0"
data_type => "list"
key =>"filebeat"
}
}
filter {
}
output {
if [app] == "www" {
if [type] == "springboot" {
elasticsearch {
hosts => ["http://192.168.1.25:9200"]
index => "springboot-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug }
}
}
}
启动logstash:
/usr/share/logstash/bin/logstash -f spring.conf
此时控制台有日志输出的话,我们就可以去kibana添加索引查看了