filebeat 采集k8s容器内日志发送到kafka
背景
我想采集一个pod内，is ti o-proxy的容器
部署filebeat Daemonset
以daemonset的方式部署filebeat，通过修改configmap控制filebeat采集日志，可以根据namespace，pod，container的名称筛选是否采集，也可以满足我们的开发需求
vim daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: filebeat-daemonset #指定daemonset的名字
namespace: dev-book #指定namespace
spec:
selector:
matchLabels:
app: filebeat
template:
metadata:
labels:
app: filebeat
spec:
containers:
- name: filebeat #指定容器的名字
image: docker.elastic.co/beats/filebeat:7.13.2
volumeMounts:
- name: config
mountPath: /usr/share/filebeat/filebeat.yml
subPath: filebeat.yml
- name: varlogcontainers
mountPath: /var/log/pods
readOnly: true
- name: varlogpods
mountPath: /var/lib/docker/containers
readOnly: true
securityContext:
runAsUser: 1000
privileged: false
resources:
requests:
cpu: 100m
memory: 200Mi
limits:
cpu: 500m
memory: 500Mi
volumes:
- name: config
configMap:
name: filebeat-config
- name: varlogcontainers
hostPath:
path: /var/log/pods
type: DirectoryOrCreate
- name: varlogpods
hostPath:
path: /var/lib/docker/containers
type: DirectoryOrCreate