Technology Sharing

한어Русский языкEnglishFrançaisIndonesianSanskrit日本語DeutschPortuguêsΕλληνικάespañolItalianoSuomalainenLatina

---

Preface

Filebeat+ELK construction and interpretation reference
Link:k8s learning – detailed process of ELK log collection based on k8s
This chapter will not repeat the description

environment

virtual machine

Version centos7.9
k8s-1.27 has been deployed
The ELK server has deployed Filebeat+ELK

This is achieved by running filebeat (sidecar) in the application Pod. This article will take Tomcat as an example.

1. Prepare the tomcat data directory

By default, there is no website homepage file in the tomcat container. If it is not added, the container in the pod will not run normally.

work01 host operation

mkdir /opt/tomcatwebroot
echo "tomcat is running" > /opt/tomcatwebroot/index.html
1
2

2. Write a tomcat application resource list file

Master host operation

vim tomcat-logs.yaml
1

apiVersion: apps/v1
kind: Deployment
metadata:
  name: tomcat-demo
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      project: www
      app: tomcat-demo
  template:
    metadata:
      labels:
        project: www
        app: tomcat-demo
    spec:
      nodeName: worker01
      containers:
      - name: tomcat
        image: tomcat:latest
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8080
          name: web
          protocol: TCP
        resources:
          requests:
            cpu: 0.5
            memory: 500Mi
          limits:
            cpu: 1
            memory: 1Gi
        livenessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 60
          timeoutSeconds: 20
        readinessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 60
          timeoutSeconds: 20
        volumeMounts:
        - name: tomcat-logs
          mountPath: /usr/local/tomcat/logs
        - name: tomcatwebroot
          mountPath: /usr/local/tomcat/webapps/ROOT

      - name: filebeat
        image: docker.io/elastic/filebeat:7.17.2
        imagePullPolicy: IfNotPresent
        args: [
          "-c", "/etc/filebeat.yml",
          "-e",
        ]
        resources:
          limits:
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 100Mi
        securityContext:
          runAsUser: 0
        volumeMounts:
        - name: filebeat-config
          mountPath: /etc/filebeat.yml
          subPath: filebeat.yml
        - name: tomcat-logs
          mountPath: /usr/local/tomcat/logs
      volumes:
      - name: tomcat-logs
        emptyDir: {}
      - name: tomcatwebroot
        hostPath:
          path: /opt/tomcatwebroot
          type: Directory
      - name: filebeat-config
        configMap:
          name: filebeat-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: default

data:
  filebeat.yml: |-
    filebeat.inputs:
    - type: log
      paths:
        - /usr/local/tomcat/logs/catalina.*

      fields:
        app: www
        type: tomcat-catalina
      fields_under_root: true
      multiline:
        pattern: '^['
        negate: true
        match: after

    setup.ilm.enabled: false
    setup.template.name: "tomcat-catalina"
    setup.template.pattern: "tomcat-catalina-*"

    output.logstash:
      hosts: ['192.168.10.17:5056']
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

This yaml defines a Tomcat and Filebeat Deployment and Filebeat configuration file. Let's explain them one by one.
Deployment section

apiVersion: apps/v1
kind: Deployment
metadata:
  name: tomcat-demo
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      project: www
      app: tomcat-demo
  template:
    metadata:
      labels:
        project: www
        app: tomcat-demo
    spec:
      nodeName: worker01
      containers:
      - name: tomcat
        image: tomcat:latest
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8080
          name: web
          protocol: TCP
        resources:
          requests:
            cpu: 0.5
            memory: 500Mi
          limits:
            cpu: 1
            memory: 1Gi
        livenessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 60
          timeoutSeconds: 20
        readinessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 60
          timeoutSeconds: 20
        volumeMounts:
        - name: tomcat-logs
          mountPath: /usr/local/tomcat/logs
        - name: tomcatwebroot
          mountPath: /usr/local/tomcat/webapps/ROOT

      - name: filebeat
        image: docker.io/elastic/filebeat:7.17.2
        imagePullPolicy: IfNotPresent
        args: [
          "-c", "/etc/filebeat.yml",
          "-e",
        ]
        resources:
          limits:
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 100Mi
        securityContext:
          runAsUser: 0
        volumeMounts:
        - name: filebeat-config
          mountPath: /etc/filebeat.yml
          subPath: filebeat.yml
        - name: tomcat-logs
          mountPath: /usr/local/tomcat/logs
      volumes:
      - name: tomcat-logs
        emptyDir: {}
      - name: tomcatwebroot
        hostPath:
          path: /opt/tomcatwebroot
          type: Directory
      - name: filebeat-config
        configMap:
          name: filebeat-config
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

metadata: defines the name and namespace of the Deployment.
spec: Contains the detailed specification of the Deployment.
replicas: specifies the number of replicas, that is, running two Tomcat instances.
selector: defines the selector used to match Pod labels.
template: describes the Pod template, including metadata and spec.
nodeName: specifies the name of the node where the Pod runs (worker01).
containers: Two containers are defined: Tomcat and Filebeat.

Tomcat container:
image: Use the tomcat:latest image.
ports: expose port 8080.
resources: defines resource requests and limits.
livenessProbe and readinessProbe: used for health checking.
volumeMounts: Two volumes are mounted.

Filebeat container:
Image: Use the filebeat:7.17.2 image.
args: specifies the startup parameters.
resources: defines resource requests and limits.
securityContext: Run as root user.
volumeMounts: Two volumes are mounted.

volumes:
tomcat-logs: Use emptyDir volume.
tomcatwebroot: Use the hostPath volume.
filebeat-config: Use ConfigMap volumes.

---

Configuration file (ConfigMap) section

apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
1
2
3
4

explain
metadata: defines the name of the ConfigMap.
data: should contain the configuration content of Filebeat (omitted here).

3. Write the logstash configuration file

elk host configuration
Write the logstash configuration file without affecting the previous configuration file

vim /etc/logstash/conf.d/tomcat-logstash-to-elastic.conf
1

input {
  beats {
    host => "0.0.0.0"
    port => "5056"
  }
}

filter {

}


output {
    elasticsearch {
      hosts => "192.168.10.17:9200"
      index => "tomcat-catalina-%{+yyyy.MM.dd}"
    }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

run

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/tomcat-logstash-to-elastic.conf --path.data /usr/share/logstash/data3 &
1

Verify that the port is enabled

ss -anput | grep ":5056"
1

4. Apply tomcat resource list file

Master host operation

kubectl apply -f tomcat-logs.yaml
1

Wait a moment because you need to download the image
Then check the pod
Note: VPN is required

kubectl get deployment.apps
kubectl get pods
1
2

5. Verify whether tomcat and filebeat in Pod are normal

View the logs generated by tomcat (-c: container)

View filebeat collection logs

 kubectl logs tomcat-demo-664584f857-k8whd -c filebeat
1

6. Add an index to the Kiana page

Host browser access

192.168.10.17:5601
1

You can see that the log has been seen.

Finish
If it helps you, please follow us.