526互联

基于 K8S 搭建自己的 ELK 服务

发布时间 2023-10-05 16:19:54作者: lamp

基于 K8S(K3S) 搭建自己的 ELK 服务

对应的 Yaml 资源在 https://github.com/nicelizhi/k8s-elk

elasticsearch 服务

Service

kind: Service
apiVersion: v1
metadata:
  name: elasticsearch
spec:
  ports:
    - name: elasticsearch
      protocol: TCP
      port: 9200
      targetPort: 9200
  selector:
    app: elasticsearch
  type: ClusterIP
  sessionAffinity: None

ConfigMap

kind: ConfigMap
apiVersion: v1
metadata:
  name: elasticsearch-config
data:
  elasticsearch.yml: |
    network.host: 0.0.0.0
    xpack.monitoring.collection.enabled: true
    http.cors.enabled: true
    http.cors.allow-origin: "*"
    xpack.security.enabled: true
    xpack.security.authc.api_key.enabled: true

Deployment

kind: Deployment
apiVersion: apps/v1
metadata:
  name: elasticsearch
spec:
  replicas: 1
  selector:
    matchLabels:
      app: elasticsearch
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      volumes:
        - name: config
          configMap:
            name: elasticsearch-config
            defaultMode: 420
        - name: es-data
          hostPath:
            path: /data/es
      initContainers:
        - name: increase-vm-max-map
          image: busybox
          command:
            - sysctl
            - '-w'
            - vm.max_map_count=262144
          securityContext:
            privileged: true
      containers:
        - name: elasticsearch
          image: 'docker.elastic.co/elasticsearch/elasticsearch:7.16.0'
          resources:
            requests:
              memory: 1524Mi
              cpu: 500m
            limits:
              memory: 1824Mi
              cpu: 1
          ports:
            - containerPort: 9200
              protocol: TCP
            - containerPort: 9300
              protocol: TCP
          env:
            - name: ES_JAVA_OPTS
              value: '-Xms256m -Xmx256m'
            - name: discovery.type
              value: single-node
          volumeMounts:
            - name: config
              mountPath: /usr/share/elasticsearch/config/elasticsearch.yml
              subPath: elasticsearch.yml
            - mountPath: /usr/share/elasticsearch/data/
              name: es-data

上面的资源有硬盘挂载与 config 类型的使用

kibana 服务

Service

kind: Service
apiVersion: v1
metadata:
  name: kibana
spec:
  ports:
    - name: kibana
      protocol: TCP
      port: 5601
      targetPort: 5601
  selector:
    component: kibana
  type: LoadBalancer

ConfigMap

kind: ConfigMap
apiVersion: v1
metadata:
  name: kibana-config
data:
  kibana.yml: >
    server.name: kibana

    server.host: 0.0.0.0

    elasticsearch.hosts: ["http://elasticsearch:9200" ]
    
    elasticsearch.username: "elastic"

    monitoring.ui.container.elasticsearch.enabled: true

Deployment

kind: Deployment
apiVersion: apps/v1
metadata:
  name: kibana
spec:
  replicas: 1
  selector:
    matchLabels:
      component: kibana
  template:
    metadata:
      labels:
        component: kibana
    spec:
      volumes:
        - name: config
          configMap:
            name: kibana-config
            defaultMode: 420
        - name: secrets
          secret:
            secretName: es-user-pass
            defaultMode: 0400
      containers:
        - name: elk-kibana
          image: 'docker.elastic.co/kibana/kibana:7.16.0'
          resources:
            requests:
              memory: 512Mi
              cpu: 200m
            limits:
              memory: 1Gi
              cpu: 1
          ports:
            - name: kibana
              containerPort: 5601
              protocol: TCP
          env:
            - name: KIBANA_SYSTEM_PASSWORD
              valueFrom: 
                secretKeyRef: 
                  name: es-user-pass
                  key: password
            - name: ELASTICSEARCH_PASSWORD
              valueFrom: 
                secretKeyRef: 
                  name: es-user-pass
                  key: password
          volumeMounts:
            - name: config
              mountPath: /usr/share/kibana/config/kibana.yml
              subPath: kibana.yml

configMap 的配置使用与 Secret内容的使用

logstash 服务

Deployment

kind: Deployment
apiVersion: apps/v1
metadata:
  name: logstash
spec:
  replicas: 1
  selector:
    matchLabels:
      app: logstash
  template:
    metadata:
      labels:
        app: logstash
    spec:
      volumes:
        - name: config
          configMap:
            name: logstash-config
            defaultMode: 420
        - name: pipelines
          configMap:
            name: logstash-pipelines
            defaultMode: 420
      containers:
        - name: logstash
          image: 'docker.elastic.co/logstash/logstash:7.16.0'
          resources:
            requests:
              memory: 512Mi
              cpu: 500m
            limits:
              memory: 1024Mi
              cpu: 1
          ports:
            - containerPort: 5044
              protocol: TCP
            - containerPort: 5000
              protocol: TCP
            - containerPort: 5000
              protocol: UDP
            - containerPort: 9600
              protocol: TCP
          env:
            - name: ELASTICSEARCH_HOST
              value: 'http://elasticsearch:9200'
            - name: LS_JAVA_OPTS
              value: '-Xms512m -Xmx512m'
          volumeMounts:
            - name: pipelines
              mountPath: /usr/share/logstash/pipeline
            - name: config
              mountPath: /usr/share/logstash/config/logstash.yml
              subPath: logstash.yml

Service

kind: Service
apiVersion: v1
metadata:
  name: logstash
spec:
  ports:
    - name: logstash
      protocol: TCP
      port: 10000
      targetPort: 9600
    - name: filebeat
      protocol: TCP
      port: 5044
      targetPort: 5044
  selector:
    app: logstash
  type: LoadBalancer
  sessionAffinity: None

ConfigMap

kind: ConfigMap
apiVersion: v1
metadata:
  name: logstash-config
  namespace: default
data:
  logstash.yml: >
    http.host: "0.0.0.0"

    xpack.monitoring.enabled: true

    config.reload.automatic: true

    xpack.monitoring.elasticsearch.hosts: ["elasticsearch:9200" ]

    xpack.monitoring.elasticsearch.username: "elastic"

    xpack.monitoring.elasticsearch.password: "abc123456"

ConfigMap piple

kind: ConfigMap
apiVersion: v1
metadata:
  name: logstash-pipelines
data:
  logstash.conf: |
    input {
      syslog {
        type => "syslog"
        port => 5044
      }
    }
    filter {
       grok {
          match => ["message", "%{SYSLOG5424PRI}%{NONNEGINT:syslog5424_ver} +(?:%{TIMESTAMP_ISO8601:timestamp}|-) +(?:%{HOSTNAME:heroku_drain_id}|-) +(?:%{WORD:heroku_source}|-) +(?:%{DATA:heroku_dyno}|-) +(?:%{WORD:syslog5424_msgid}|-) +(?:%{SYSLOG5424SD:syslog5424_sd}|-|) +%{GREEDYDATA:heroku_message}"]
        }
        mutate { rename => ["heroku_message", "message"] }
        kv { source => "message" }
        mutate { convert => ["sample#memory-free", "integer"]}
        mutate { convert => ["sample#memory-total", "integer"]}
        mutate { convert => ["sample#memory-redis", "integer"]}
        mutate { convert => ["sample#memory-cached", "integer"]}
        mutate { convert => ["sample#load-avg-5m", "float"]}
        mutate { convert => ["sample#load-avg-1m", "float"]}
        mutate { convert => ["sample#load-avg-15m", "float"]}
        syslog_pri { syslog_pri_field_name => "syslog5424_pri" }
    }
    output {
      elasticsearch {
        hosts => ["http://elasticsearch:9200"]
        "user" => "elastic"
        "password" => "abc123456"
        "index" => "logstash-%{heroku_dyno}"
         template_overwrite => true
      }
    }

pipe 日志处理了 Heroku 平台日志收集。并且配置了pipe的自动加载动作，这块也是实际应用中经常应用到的功能
针对与日志收集的过程中可以使用 grok 去做必要的格式转化，从而使的日志安装您的要求保存到ES 服务器中使用。

上面示例是运行在一台 2核 4G 的服务器上面，所以我们使用的是K3S 架构，并且在 ES 上只使用了一个节点数据，这些在正式的使用过程中需要多留意。