kubernetes(k8s) 安装 elk_kubernetes搭建elk-CSDN博客

本文链接：https://blog.csdn.net/yujia_666/article/details/109344014

kubernetes(k8s) 安装 elk

elk是elasticsearch,logstash,kibana的缩写，组成了日志收集的服务端。在看这篇文章，要先了解以下二篇文章：

ubuntu elasticsearch,logstash,kibana,filebeat安装配置

kubernetes(k8s) 集群安装配置

一，elk的选择

方案一，用k8s分别安装elasticsearch,logstash,kibana，配置要复杂一点，但是灵活度要高一点

方案二，用已集成好的elk来安装，这也本文采取的方式

查看复制打印 ?

[root@bigserver3 elk]# docker search elk
NAME DESCRIPTION STARS OFFICIAL AUTOMATED
sebp/elk Collect, search and visualise log data with … 1004 [OK]
qnib/elk Dockerfile providing ELK services (Elasticse… 108 [OK]
willdurand/elk Creating an ELK stack could not be easier. 103 [OK]
sebp/elkx Collect, search and visualise log data with … 40 [OK]
elkarbackup/elkarbackup ElkarBackup is a free open-source backup sol… 14 [OK]
elkozmon/zoonavigator-web This repository is DEPRECATED, use elkozmon/… 13
grubykarol/elk-docker elk docker image (derived from spujadas/elk-… 7 [OK]
...............................................省略................................................

选第一个，星最多

二，制作安装elk配置文件

1，生成namespace配置文件elk-namespace.yaml

查看复制打印 ?

[root@bigserver3 elk]# cat elk-namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
name: elk
labels:
name: elk
[root@bigserver3 elk]# kubectl apply -f elk-namespace.yaml //执行
[root@bigserver3 elk]# kubectl get ns //查看namespace
NAME STATUS AGE
default Active 11d
elk Active 7h5m //执行成功
kube-node-lease Active 11d
kube-public Active 11d
kube-system Active 11d
kubernetes-dashboard Active 10d

2，配置elk logstash容器里面配置

查看复制打印 ?

[root@bigserver3 elk]# cat elk-logstash-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: logstash-config
namespace: elk
data:
02-beats-input.conf: |
input {
beats {
port => 5044
}
}
30-output.conf: |
output {
elasticsearch {
hosts => ["127.0.0.1:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
}
}
10-syslog.conf: |
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
11-nginx.conf: |
filter {
if [type] == "nginx-access" {
grok {
match => { "message" => "%{NGINXACCESS}" }
}
}
}
[root@bigserver3 elk]# kubectl create -f elk-logstash-configmap.yaml //创建
configmap/logstash-config created
[root@bigserver3 elk]# kubectl get configmap -n elk //查看
NAME DATA AGE
logstash-config 4 32m

其实有input,output就够了。

3，配置elk-deployment.yaml

查看复制打印 ?

[root@bigserver3 elk]# cat elk-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: elk
namespace: elk
labels:
app: elk
spec:
replicas: 1
selector:
matchLabels:
app: elk
template:
metadata:
labels:
app: elk
spec:
nodeSelector:
nodetype: elk
containers:
- name: elk
image: sebp/elk
tty: true
ports:
- containerPort: 5601
- containerPort: 5044
- containerPort: 9200
volumeMounts:
- name: data
mountPath: /var/lib/elasticsearch
- name: logstash-volume
mountPath: /etc/logstash/conf.d
initContainers:
- name: fix-permissions
image: busybox
command: ["sh", "-c", "chmod 777 -R /var/lib/elasticsearch"]
securityContext:
privileged: true
volumeMounts:
- name: data
mountPath: /var/lib/elasticsearch
- name: increase-vm-max-map
image: busybox
command: ["sysctl", "-w", "vm.max_map_count=262144"]
securityContext:
privileged: true
- name: increase-fd-ulimit
image: busybox
command: ["sh", "-c", "ulimit -n 65536"]
securityContext:
privileged: true
volumes:
- name: data
hostPath:
path: /var/lib/elasticsearch
- name: logstash-volume
configMap:
name: logstash-config
items:
- key: 02-beats-input.conf
path: 02-beats-input.conf
- key: 30-output.conf
path: 30-output.conf
- key: 10-syslog.conf
path: 10-syslog.conf
- key: 11-nginx.conf
path: 11-nginx.conf
[root@bigserver3 elk]# kubectl create --validate -f elk-deployment.yaml
deployment.apps/elk created //创建deployment

解释：

a),namespace: elk，是elk是空间名，上一步创建的

b),nodeSelector:
nodetype: elk，这里的nodetype: elk是设置的label名，创建方法如下：

查看复制打印 ?

[root@bigserver3 elk]# kubectl label nodes bigserver2 nodetype=elk
node/bigserver2 labeled
[root@bigserver3 elk]# kubectl get nodes --show-labels |grep elk //查看

整体的意思是，选择label为elk的节点，启动pod。如果取消该配置，在什么节点启动pod，由k8s自己决定。

如果nodeSelector配置错误，有以下二点表现：

查看复制打印 ?

[root@bigserver3 elk]# kubectl get pod -n elk
NAME READY STATUS RESTARTS AGE
elk-86788c944f-jpwr4 0/1 Pending 0 15m
[root@bigserver3 elk]# kubectl describe pods/elk-86788c944f-jpwr4 -n elk
Name: elk-86788c944f-jpwr4
Namespace: elk
Priority: 0
Node:
Labels: app=elk
pod-template-hash=86788c944f
Annotations:
Status: Pending
IP:
IPs:
Controlled By: ReplicaSet/elk-86788c944f
Containers:
elk:
Image: sebp/elk
Ports: 5601/TCP, 5044/TCP, 9200/TCP
Host Ports: 0/TCP, 0/TCP, 0/TCP
Environment:
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from default-token-v7xtf (ro)
Conditions:
Type Status
PodScheduled False
Volumes:
default-token-v7xtf:
Type: Secret (a volume populated by a Secret)
SecretName: default-token-v7xtf
Optional: false
QoS Class: BestEffort
Node-Selectors: type=elk
Tolerations: node.kubernetes.io/not-ready:NoExecute for 300s
node.kubernetes.io/unreachable:NoExecute for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Warning FailedScheduling default-scheduler 0/3 nodes are available: 3 node(s) didn't match node selector.
Warning FailedScheduling default-scheduler 0/3 nodes are available: 3 node(s) didn't match node selector.

pod的状态是pending状态。didn't match node selector，没有匹配到任何节点来启动pod。

c),command: ["sysctl", "-w", "vm.max_map_count=262144"]，如果这步不设置，也是启动不了的。报以下错误

ERROR: [1] bootstrap checks failed
[1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
ERROR: Elasticsearch did not exit normally - check the logs at /var/log/elasticsearch/elasticsearch.log

k8s elk max_map_count报错

k8s的deployment的配置非常多，上面几个配置是要重点注意的。

d)，将configmap转化成容器内部的配置文件，下面是转化前后对比

4，配置elk-elastic.yaml

[root@bigserver3 elk]# cat elk-elastic.yaml
apiVersion: v1
kind: Service
metadata:
name: elk-elastic
namespace: elk
spec:
type: ClusterIP
ports:
- port: 9200
targetPort: 9200
selector:
app: elk
[root@bigserver3 elk]# kubectl create -f elk-elastic.yaml
service/elk-elastic created

注释：type: ClusterIP

ClusterIP：通过集群的内部 IP 暴露服务，选择该值，服务只能够在集群内部可以访问，这也是默认的 ServiceType。
NodePort：通过每个 Node 上的 IP 和静态端口（NodePort）暴露服务。NodePort 服务会路由到 ClusterIP 服务，这个 ClusterIP 服务会自动创建。通过请求 <NodeIP>:<NodePort>，可以从集群的外部访问一个 NodePort 服务。
LoadBalancer：使用云提供商的负载局衡器，可以向外部暴露服务。外部的负载均衡器可以路由到 NodePort 服务和 ClusterIP 服务。
ExternalName：通过返回 CNAME 和它的值，可以将服务映射到 externalName 字段的内容（例如， foo.bar.example.com）。没有任何类型代理被创建。

到底是使用ClusterIP，NodePort或者其他，根据实际情况来。如果需要node间能访问，就需要NodePort。

5，配置elk-kibana.yaml