基于K8S实现EFK日志收集

curl -L "https://github.com/docker/compose/releases/download/v2.2.3/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-composechmod a+x /usr/local/bin/docker-compose

version: '3.9'services:  elasticsearch:    image: elasticsearch:7.13.3    container_name: elasticsearch    volumes:      - ./data/local/elasticsearch/data:/usr/share/elasticsearch/data　　#这里将elasticsearch的数据文件映射本地，以保证下次如果删除>了容器还有数据    environment:      - discovery.type=single-node      - bootstrap.memory_lock=true      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"    ports:      - "9200:9200"        kibana:    image: kibana:7.13.3    container_name: kibana    depends_on:      - elasticsearch     environment:      ELASTICSEARCH_HOSTS: http://ip:9200 #设置elasticsearch      I18N_LOCALE: zh-CN    ports:      - 5601:5601

apiVersion: v1kind: ConfigMapmetadata:  name: filebeatconfdata:  filebeat.yml: |-    filebeat.inputs:    - input_type: log      paths:        - /data/logs/*.log         # 收集日志的路径        - /data/logs/*/*         # 收集日志的路径              tail_files: true      fields:        pod_name: '${podName}'        pod_ip: '${podIp}'        pod_deploy_name: '${podDeployName}'        pod_namespace: '${podNamespace}'      fields_under_root: true    setup.ilm.enabled: false    setup.template.name: "${podNamespace}"    setup.template.pattern: "${podNamespace}-*"    output.elasticsearch:        hosts: ["192.168.1.239:9200"]    # elasticsearch 的ip+port      index: "${podNamespace}-%{+yyyy.MM.dd}"     # 索引名称定义

---kind: DeploymentapiVersion: apps/v1metadata:  name: java-1-dev  namespace: dev  annotations: {}spec:  replicas: 1  selector:    matchLabels:      app: java-1-dev  template:    metadata:      creationTimestamp: null      labels:        app: java-1-dev      annotations:        kubectl.kubernetes.io/restartedAt: '2023-07-18T11:27:26+08:00'    spec:      volumes:        - name: data-log          hostPath:            path: /tmp/hostpath            type: ''        - name: logpath          emptyDir: {}        - name: local-time          hostPath:            path: /usr/share/zoneinfo/Asia/Shanghai            type: ''        - name: filebeatconf          configMap:            name: filebeatconf            items:              - key: filebeat.yml                path: filebeat.yml            defaultMode: 420      containers:        - name: filebeat          image: 'registry.cn-beijing.aliyuncs.com/dotbalo/filebeat:7.10.2'          env:            - name: podIp              valueFrom:                fieldRef:                  apiVersion: v1                  fieldPath: status.podIP            - name: podName              valueFrom:                fieldRef:                  apiVersion: v1                  fieldPath: metadata.name            - name: podNamespace              valueFrom:                fieldRef:                  apiVersion: v1                  fieldPath: metadata.namespace            - name: podDeployName              value: java-1-dev            - name: TZ              value: Asia/Shanghai          resources:            limits:              cpu: 200m              memory: 300Mi            requests:              cpu: 10m              memory: 100Mi          volumeMounts:            - name: data-log              mountPath: /data/logs/   #将服务日志挂载到filebeat，filebeat从这边路径下收集日志            - name: filebeatconf              mountPath: /usr/share/filebeat/filebeat.yml              subPath: filebeat.yml          terminationMessagePath: /dev/termination-log          terminationMessagePolicy: File          imagePullPolicy: IfNotPresent          securityContext:            runAsUser: 0        - name: java-1-dev          image: '192.168.1.123:9010/java/java-1-dev:dev-30'          ports:            - containerPort: 80              protocol: TCP          env:            - name: HOST_IP              valueFrom:                fieldRef:                  apiVersion: v1                  fieldPath: status.hostIP            - name: NAMESPACE              valueFrom:                fieldRef:                  apiVersion: v1                  fieldPath: metadata.namespace            - name: POD_IP              valueFrom:                fieldRef:                  apiVersion: v1                  fieldPath: status.podIP            - name: POD_NAME              valueFrom:                fieldRef:                  apiVersion: v1                  fieldPath: metadata.name          resources: {}          volumeMounts:            - name: data-log              mountPath: /logs   #服务中的日志路径          terminationMessagePath: /dev/termination-log          terminationMessagePolicy: File          imagePullPolicy: IfNotPresent      restartPolicy: Always      terminationGracePeriodSeconds: 30      dnsPolicy: ClusterFirst      securityContext: {}      schedulerName: default-scheduler  strategy:    type: RollingUpdate    rollingUpdate:      maxUnavailable: 25%      maxSurge: 25%  revisionHistoryLimit: 10  progressDeadlineSeconds: 600