Technology sharing

한어Русский языкEnglishFrançaisIndonesianSanskrit日本語DeutschPortuguêsΕλληνικάespañolItalianoSuomalainenLatina

---

Praefatio

Filebeat+ ELK constructio et interpretatio reference
Link:k8s doctrina - detailed processus ELK log collection secundum k8s
Hoc caput non iterare descriptionem

environment

virtualis apparatus

Version centos7.9
Explicuit k8s-1.27
ELK servo Filebeat explicavit+ ELK

Hoc tempus in applicatione Pod, Tomcat currendo filebeat.

Para tomcat 1. data Directory

Defalta nulla pagina paginae paginae in vase tomcat.

work01 exercitum operandi

mkdir /opt/tomcatwebroot
echo "tomcat is running" > /opt/tomcatwebroot/index.html
1
2

2. scribe tomcat application resource album file

dominus exercitum operandi

vim tomcat-logs.yaml
1

apiVersion: apps/v1
kind: Deployment
metadata:
  name: tomcat-demo
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      project: www
      app: tomcat-demo
  template:
    metadata:
      labels:
        project: www
        app: tomcat-demo
    spec:
      nodeName: worker01
      containers:
      - name: tomcat
        image: tomcat:latest
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8080
          name: web
          protocol: TCP
        resources:
          requests:
            cpu: 0.5
            memory: 500Mi
          limits:
            cpu: 1
            memory: 1Gi
        livenessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 60
          timeoutSeconds: 20
        readinessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 60
          timeoutSeconds: 20
        volumeMounts:
        - name: tomcat-logs
          mountPath: /usr/local/tomcat/logs
        - name: tomcatwebroot
          mountPath: /usr/local/tomcat/webapps/ROOT

      - name: filebeat
        image: docker.io/elastic/filebeat:7.17.2
        imagePullPolicy: IfNotPresent
        args: [
          "-c", "/etc/filebeat.yml",
          "-e",
        ]
        resources:
          limits:
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 100Mi
        securityContext:
          runAsUser: 0
        volumeMounts:
        - name: filebeat-config
          mountPath: /etc/filebeat.yml
          subPath: filebeat.yml
        - name: tomcat-logs
          mountPath: /usr/local/tomcat/logs
      volumes:
      - name: tomcat-logs
        emptyDir: {}
      - name: tomcatwebroot
        hostPath:
          path: /opt/tomcatwebroot
          type: Directory
      - name: filebeat-config
        configMap:
          name: filebeat-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: default

data:
  filebeat.yml: |-
    filebeat.inputs:
    - type: log
      paths:
        - /usr/local/tomcat/logs/catalina.*

      fields:
        app: www
        type: tomcat-catalina
      fields_under_root: true
      multiline:
        pattern: '^['
        negate: true
        match: after

    setup.ilm.enabled: false
    setup.template.name: "tomcat-catalina"
    setup.template.pattern: "tomcat-catalina-*"

    output.logstash:
      hosts: ['192.168.10.17:5056']
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

Hoc yaml definit Tomcat et Filebeat instruere et Filebeat imaginum fasciculos.
Instruere sectionem

apiVersion: apps/v1
kind: Deployment
metadata:
  name: tomcat-demo
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      project: www
      app: tomcat-demo
  template:
    metadata:
      labels:
        project: www
        app: tomcat-demo
    spec:
      nodeName: worker01
      containers:
      - name: tomcat
        image: tomcat:latest
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8080
          name: web
          protocol: TCP
        resources:
          requests:
            cpu: 0.5
            memory: 500Mi
          limits:
            cpu: 1
            memory: 1Gi
        livenessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 60
          timeoutSeconds: 20
        readinessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 60
          timeoutSeconds: 20
        volumeMounts:
        - name: tomcat-logs
          mountPath: /usr/local/tomcat/logs
        - name: tomcatwebroot
          mountPath: /usr/local/tomcat/webapps/ROOT

      - name: filebeat
        image: docker.io/elastic/filebeat:7.17.2
        imagePullPolicy: IfNotPresent
        args: [
          "-c", "/etc/filebeat.yml",
          "-e",
        ]
        resources:
          limits:
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 100Mi
        securityContext:
          runAsUser: 0
        volumeMounts:
        - name: filebeat-config
          mountPath: /etc/filebeat.yml
          subPath: filebeat.yml
        - name: tomcat-logs
          mountPath: /usr/local/tomcat/logs
      volumes:
      - name: tomcat-logs
        emptyDir: {}
      - name: tomcatwebroot
        hostPath:
          path: /opt/tomcatwebroot
          type: Directory
      - name: filebeat-config
        configMap:
          name: filebeat-config
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

metadata: nomen et nomina spatium instruere.
spec: Continet detailed specificationem instruere.
replicas: denotat numerum replicationum, hoc est, instantiarum duarum tomcatorum currentium.
electrix: electrix definit pro adaptandi Pod labels.
template: describit Pod template, additis metadata et spec.
nodeName: significat nodi nomen (worker01) ubi Pod currit.
continentia: Duo vasa definiuntur: Tomcat et Filebeat.

Tomcat continens:
image: Use tomcat: latest image.
portus : Exponere portum 8080 .
opes: definit resource petitiones et limites.
livenessProbe and readinessProbe : usus ad salutem compescit.
volumeMounts: Duo volumina conscendit.

Filebeat continens:
image: Use filebeat: 7.17.2 image.
args: parametri speciem startup.
opes: definit resource petitiones et limites.
securityContext: Curre ut radix user.
volumeMounts: Duo volumina conscendit.

voluminibus;
tomcat-logs: Utere codicibus emptyDir.
tomcatwebroot: Utere volumine hostPath.
filebeat-config: ConfigMap voluminibus utere.

---

Configurationis file (ConfigMap) section

apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
1
2
3
4

explicare
metadata: Nomen ConfigMap definit.
data: continere debet configurationem contentum Filebeat (hic omissum).

Logstash configuratione Write 3. file

elk exercitum configuratione
Scribere logstash configuratione files sine aliqua prior configuratione files "

vim /etc/logstash/conf.d/tomcat-logstash-to-elastic.conf
1

input {
  beats {
    host => "0.0.0.0"
    port => "5056"
  }
}

filter {

}


output {
    elasticsearch {
      hosts => "192.168.10.17:9200"
      index => "tomcat-catalina-%{+yyyy.MM.dd}"
    }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

Curre

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/tomcat-logstash-to-elastic.conf --path.data /usr/share/logstash/data3 &
1

Quin usque ad portum est

ss -anput | grep ":5056"
1

4. applicare tomcat resource album file

dominus exercitum operandi

kubectl apply -f tomcat-logs.yaml
1

Exspecta paulisper quod debes imaginem download
Tum reprehendo legumen
Nota: VPN requiratur

kubectl get deployment.apps
kubectl get pods
1
2

5. Cognoscere an tomcat et filebeat in Pod are normal?

View tomcat generatae omnia (-c: continens)

Visum filebeat ligna collection

 kubectl logs tomcat-demo-664584f857-k8whd -c filebeat
1

6. Adde indicem ad kiana paginam

Hostia pasco accessum

192.168.10.17:5601
1

Videre potes quod stipem vidisti

perago
Si te adiuvat, preme et sequere