Relk's 工作手札

在 Cloud-Native 汪洋中載浮載沉的 SRE - Service Restart Engineer

0%

[Elastic] 利用 Filebeat 來收集與解析 Kubernetes nginx ingress logs

前言

最近在配置 Filebeat 在 Kubernetes 上解析 nginx-ingress logs 時遇到了一些困難,主要是 autodiscoverhints 部份在新舊版本上有些差異,這邊將我最後測試成功的配置給記錄下來

環境

  • GKE Container-Optimized OS
  • Filebeat: 7.7.1
  • ElasticSearch: 7.7.1
  • Kubernetes/ingress-nginx: 0.32.0

配置

helm chart: elastic/filebeat

1
2
3
4
5
6
7
8
9
10
11
12
13
14
filebeatConfig:
filebeat.yml: |
filebeat.autodiscover:
providers:
- type: kubernetes
hints.enabled: true
hints.default_config.enabled: false

output.elasticsearch:
host: '${NODE_NAME}'
hosts: '${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}'
protocol: http
username: '${ELASTICSEARCH_USERNAME}'
password: '${ELASTICSEARCH_PASSWORD}'

helm chart: ingress-nginx/ingress-nginx

1
2
3
4
5
6
7
## Annotations to be added to controller pods
##
podAnnotations:
co.elastic.logs/enabled: "true"
co.elastic.logs/module: "nginx"
co.elastic.logs/fileset.stdout: "ingress_controller"
co.elastic.logs/fileset.stderr: "error"

參考資料

Follow me at the links below