[Elastic] 利用 Filebeat 來收集與解析 Kubernetes nginx ingress logs

前言

最近在配置 Filebeat 在 Kubernetes 上解析 nginx-ingress logs 時遇到了一些困難，主要是 autodiscover 與 hints 部份在新舊版本上有些差異，這邊將我最後測試成功的配置給記錄下來

環境

• GKE Container-Optimized OS
• Filebeat: 7.7.1
• ElasticSearch: 7.7.1
• Kubernetes/ingress-nginx: 0.32.0

配置

helm chart: elastic/filebeat

filebeatConfig:
  filebeat.yml: |
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          hints.enabled: true
          hints.default_config.enabled: false

    output.elasticsearch:
      host: '${NODE_NAME}'
      hosts: '${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}'
      protocol: http
      username: '${ELASTICSEARCH_USERNAME}'
      password: '${ELASTICSEARCH_PASSWORD}'

helm chart: ingress-nginx/ingress-nginx

## Annotations to be added to controller pods
##
podAnnotations: 
  co.elastic.logs/enabled: "true"
  co.elastic.logs/module: "nginx"
  co.elastic.logs/fileset.stdout: "ingress_controller"
  co.elastic.logs/fileset.stderr: "error"

參考資料

• Error extracting container id - source value does not contain matcher’s logs_path ‘/var/lib/docker/containers/‘
• Problem to update to filebeat 7.7.0 and parser nginx-ingress-controller on Kubernetes