专栏首页JetpropelledSnakeK8S学习笔记之filebeat采集K8S微服务java堆栈多行日志

K8S学习笔记之filebeat采集K8S微服务java堆栈多行日志

0x00 背景

K8S内运行Spring Cloud微服务,根据定制容器架构要求log文件不落地,log全部输出到std管道,由基于docker的filebeat去管道采集,然后发往Kafka或者ES集群。

0x01 多行匹配和yaml文件

在filebeat启动的yaml文件内,指定相应的名称空间并配置java堆栈的多行解析规则,如下yaml文件输出端是kafka,如需要输出到es集群,可更改对应配置

apiVersion: v1
kind: Namespace
metadata:
  name: logging
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: filebeat
  namespace: logging
  labels:
    k8s-app: filebeat
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: filebeat
  namespace: logging
  labels:
    k8s-app: filebeat
rules:
- apiGroups: [""]
  resources:
  - namespaces
  - pods
  verbs:
  - get
  - watch
  - list
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: filebeat
  namespace: logging
subjects:
- kind: ServiceAccount
  name: filebeat
  namespace: logging
roleRef:
  kind: ClusterRole
  name: filebeat
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: logging
  labels:
    k8s-app: filebeat
    kubernetes.io/cluster-service: "true"
data:
  filebeat.yml: |-
    filebeat.config:
    #  inputs:
    #    path: ${path.config}/inputs.d/*.yml
    #    reload.enabled: true
      modules:
        path: ${path.config}/modules.d/*.yml
        reload.enabled: true

    filebeat.autodiscover:
      providers:
        - type: kubernetes
          hints.enabled: true
          templates:
            - condition:
                equals:
                  # java堆栈对行日志出现的名称空间为wfw
                  kubernetes.namespace: wfw 
              config:
                - type: docker
                  containers.ids:
                    - "${data.kubernetes.container.id}"
                  # 配置java堆栈多行匹配规则
                  multiline: 
                    pattern: '^[[:space:]]+(at|\\.{3}\\b|^Caused by:)' 
                    negate: false
                    match: after
            - condition:
                equals:
                  kubernetes.namespace: kube-system
              config:
                - type: docker
                  containers.ids:
                    - "${data.kubernetes.container.id}"
    # 输出数据到kafka               
    output.kafka:
      enable: true
      hosts: ["xx.xx.xx.xx:9092","xx.xx.xx.xx:9092","xx.xx.xx.xx:9092"]
      topic: k8s_log
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-inputs
  namespace: logging
  labels:
    k8s-app: filebeat
    kubernetes.io/cluster-service: "true"
data:
  kubernetes.yml: |-
    - type: docker
      containers.ids:
      - "*"
      processors:
        - add_kubernetes_metadata:
            in_cluster: true
      multiline:
        pattern: '^[A-Za-z ]+[0-9]{2} (?:[01]\d|2[0123]):(?:[012345]\d):(?:[012345]\d)'
        negate: true
        match: after
---
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: filebeat
  namespace: logging
  labels:
    k8s-app: filebeat
spec:
  template:
    metadata:
      labels:
        k8s-app: filebeat
    spec:
      serviceAccountName: filebeat
      terminationGracePeriodSeconds: 30
      containers:
      - name: filebeat
        image: 10.131.141.200/public/filebeat:6.5.4
        args: [
          "-c", "/usr/share/filebeat/filebeat.yml",
          "-e",
        ]
        securityContext:
          runAsUser: 0
          # If using Red Hat OpenShift uncomment this:
          #privileged: true
        resources:
          limits:
            cpu: 100m
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 200Mi
        volumeMounts:
        - name: config
          mountPath: /usr/share/filebeat/filebeat.yml
          readOnly: true
          subPath: filebeat.yml
        - name: inputs
          mountPath: /usr/share/filebeat/inputs.d
          readOnly: true
        - name: data
          mountPath: /usr/share/filebeat/data
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
      volumes:
      - name: config
        configMap:
          defaultMode: 0600
          name: filebeat-config
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
      - name: inputs
        configMap:
          defaultMode: 0600
          name: filebeat-inputs
      # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart
      - name: data
        hostPath:
          path: /var/lib/filebeat-data
          type: DirectoryOrCreate
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: filebeat
  namespace: logging
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: filebeat
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: filebeat
  namespace: logging

0x02 结论

参考1 https://www.elastic.co/guide/en/beats/filebeat/6.7/_examples_of_multiline_configuration.html

参考2 https://stackoverflow.com/questions/50931623/multi-line-logs-into-es-from-filebeat-deployed-as-kubernetes-daemonset

本文参与腾讯云自媒体分享计划,欢迎正在阅读的你也加入,一起分享。

我来说两句

0 条评论
登录 后参与评论

相关文章

  • MySQL学习之Can't connect to MySQL server on localhost (10061)

    最近升级 了系统,开机后连接MySQL报错,Can't connect to MySQL server on localhost (10061); 估计是升级系...

    Jetpropelledsnake21
  • Django学习笔记之Ajax入门

    Jetpropelledsnake21
  • ELK学习笔记之Logstash不停机自动重载配置文件

    为了可以自动检测配置文件的变动和自动重新加载配置文件,需要在启动的时候使用以下命令:

    Jetpropelledsnake21
  • Python高级进阶#005 pyqt5显示提示框

    注意:基本上所有的控件,包括窗体都有setToolTip这个函数,也就是说这个函数基本上都有。

    刘金玉编程
  • Python基础学习00天

    你好我是森林
  • 条码打印软件中如何实现条形码随文本数据变化而变化

    用条码打印软件制作产品标签有时候可能需要把制作的条形码和标签上某些文本数据关联,随着变化而变化,方便产品和产品之间的区分标记等等,这些功能在条码打印软件中用数据...

    中琅软件
  • 电子签名实现的思路、困难及解决方案

            在办公自动化的流程中希望实现电子签名。         思路:             1、图片的存放:安全起见存放在库中为宜。最好不能被轻易下...

    用户1075292
  • 第十三课 如何在DAPP应用实现自带钱包转账功能?

    区块链是一个伟大的发明,它改变了生产关系。很多生态,有了区块链技术,可以由全公司员工的"全员合伙人"变成了全平台的”全体合伙人”了,是真正的共享经济模式。

    辉哥
  • MATLAB识别笔记本内置摄像头

    内置摄像头 想要使用笔记本内置摄像头采集图像信息,调用硬件设备前在软件中检查相关信息 运行情况如下 >> imaqhwinfo 警告: No Image Ac...

    万木逢春
  • 使用EndNote管理文献1.EndNote2.下载安装3.登录客户端4.同步EndNote Web5.关联Micrasoft Word

    1.EndNote 官网 知乎 2.下载安装 链接 3.登录客户端 选项->首选项->同步(Sync) ? 具体的EndNote使用方法,网上有很多,...

    JasonhavenDai

扫码关注云+社区

领取腾讯云代金券