Linux系统中K8S日志管理实战指南
一 日志来源与采集原则
二 采集架构与工具选型
三 快速上手步骤
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/containers/*.log
processors:
- add_kubernetes_metadata:
host: ${NODE_NAME}
matchers:
- logs_path:
logs_path: /var/log/containers/
output.elasticsearch:
hosts: ["http://elasticsearch:9200"]
[INPUT]
@type tail
path /var/log/containers/*.log
parser docker
refresh_interval 10
[FILTER]
@type kubernetes
kubernetes_url https://kubernetes.default.svc:443
bearer_token_file /var/run/secrets/kubernetes.io/serviceaccount/token
kubernetes_tag_prefix k8s
[OUTPUT]
@type elasticsearch
hosts http://elasticsearch:9200
index_name k8s-logs-%{+YYYY.MM.dd}
spec:
volumes:
- name: logs
emptyDir: {}
containers:
- name: app
image: nginx:1.25
volumeMounts:
- name: logs
mountPath: /var/log/nginx
- name: filebeat
image: docker.elastic.co/beats/filebeat:8.9
volumeMounts:
- name: logs
mountPath: /var/log/nginx
- name: filebeat-config
mountPath: /usr/share/filebeat/filebeat.yml
readOnly: true
四 存储与保留策略
五 运维规范与最佳实践