ELK收集Kubernetes平台日志

ELK收集Kubernetes平台日志

如果把日志保存在容器内部或通过数据卷挂载在宿主机上还是保持在远程存储上，比如保存在容器内部，也就是说没有经过任何改动，自是在容器里原封不动的启动了，起来之后日志还是和原来一样保持在原来的目录里，但是这个容器是会经常的删除，销毁和创建是常态。因此我们需要一种持久化的保存日志方式。

如果日志还是放在容器内部，会随着容器删除而被删除

容器数量很多，按照传统的查看日志方式变得不太现实

容器本身特性

容器密集，采集目标多：容器日志输出到控制台，docker本身提供了一种能力来采集日志了。如果落地到本地文件目前还没有一种好的采集方式

容器的弹性伸缩：新扩容的pod属性信息(日志文件路径，日志源)可能会发送变化

收集那些日志

K8S系统的组件日志和应用程序日志，组件日志就是打到宿主机的固定文件和传统的日志收集一样，应用程序日志又分为了标准输出和日志文件。这里以nginx和tomcat说明下这两种方式

用docker先运行一个nginx

[root@k8s02 ~]# docker run -d nginx
feed659283b4adb5d24f0bc736ed83be8130ecdbd52d9cc2a7424ede108d0de3
[root@k8s02 ~]# 

测试访问容器

[root@k8s02 ~]# curl 172.17.0.2

查看nginx日志

[root@k8s02 ~]# docker logs determined_feynman
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
172.17.0.1 - - [04/Jun/2020:14:38:24 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.29.0" "-"
[root@k8s02 ~]# 

这是docker将这个日志进行了接管，这实际是控制台的日志，进入nginx看看日志

[root@k8s02 ~]# docker exec -it determined_feynman /bin/bash
root@feed659283b4:/# cd /var/log/nginx/
root@feed659283b4:/var/log/nginx# ls -l 
total 0
lrwxrwxrwx 1 root root 11 Jun  2 00:35 access.log -> /dev/stdout
lrwxrwxrwx 1 root root 11 Jun  2 00:35 error.log -> /dev/stderr
root@feed659283b4:/var/log/nginx# 

官方在写dockerfile时将这两个日志文件给输出到了控制台，就是标准输出和错误输出都输出到控制台中，控制台的日志都可以通过docker logs 访问到。

用docker运行一个tomcat

[root@k8s03 ~]# docker run -d tomcat
40c6b2d99726544c93973bd42297ce14d1e820979a0463fb4a99d1e3a493a579
[root@k8s03 ~]# 

进入到tomcat里面

[root@k8s03 ~]# docker exec -it flamboyant_kepler /bin/bash
root@40c6b2d99726:/usr/local/tomcat# cd logs/
root@40c6b2d99726:/usr/local/tomcat/logs# ls -l
total 8
-rw-r----- 1 root root 4790 Jun  4 14:36 catalina.2020-06-04.log
-rw-r----- 1 root root    0 Jun  4 14:36 host-manager.2020-06-04.log
-rw-r----- 1 root root    0 Jun  4 14:36 localhost.2020-06-04.log
-rw-r----- 1 root root    0 Jun  4 14:36 localhost_access_log.2020-06-04.txt
-rw-r----- 1 root root    0 Jun  4 14:36 manager.2020-06-04.log
root@40c6b2d99726:/usr/local/tomcat/logs# 

会发现是有日志的，tomcat产生的文件有一部分会产生到控制台，一部分落到本地的文件中，他没有将这些日志做重定向，而是存在于容器内部的，如果容器删除的话，日志也会删除。

总结

根据以上镜像的情况，归出了两种日志体现，一个是标准输出，一个是日志输出

如果使用标准的日志输出，其实docker已经涉及到这一块了，比如容器→docker→文件系统，日志驱动在容器通过控制台日志输出由docker接管了，可以docker logs可以看到，执行docker logs时是调用了守护进程，守护进程读取的这个接管的日志从本地文件系统中读取这个日志，日志路径在一下位置

[root@k8s02 ~]# cd /var/lib/docker/containers/d8ab1b4e6a01d9124ad1d07bf852bf69e2768ecdc5dd0a644e97518537ea2932/
[root@k8s02 d8ab1b4e6a01d9124ad1d07bf852bf69e2768ecdc5dd0a644e97518537ea2932]# ll
total 16
drwx------ 2 root root    6 Jun  4 22:41 checkpoints
-rw------- 1 root root 6801 Jun  4 22:41 config.v2.json
-rw-r----- 1 root root  666 Jun  4 22:41 d8ab1b4e6a01d9124ad1d07bf852bf69e2768ecdc5dd0a644e97518537ea2932-json.log
-rw-r--r-- 1 root root 2153 Jun  4 22:41 hostconfig.json
drwx------ 2 root root    6 Jun  4 22:41 mounts

可以看到有一个为容器ID开头的json文件，实际上它是从这里来读取日志响应到控制台的，docker还支持fluned、syslog等采集工具

如果使用日志文件写到容器中比如tomcat这样的，一般的做法通过 docker bind mount或volumes将他挂载到宿主机上，去采集宿主机的目录。

ELK日志收集的三个方案

大致分为采集阶段→数据存储→分析→展示

方式	优点	缺点
Node上部署一个日志收集程序	每个Nodej仅需部署一个日志收集程序，资源消耗少，对应用无侵入	应用程序日志如果写到标准输出和标准错误输出，那就不支持多行日志。
Pod中附加专用日志收集的容器	低耦合	每个Pod启动一个日志收集代理，增加资源消耗，并增加运维维护成本
应用程序直接推送日志	无需额外收集工具	侵入应用，增加应用复杂度

Node上部署一个日志收集程序

DaemonSet方式部署日志收集程序，对本节点/var/log/pods/或/var/lib/docker/containers/两个目录下的日志进行收集

Pod中附加专用日志收集的容器

每个运行应用程序的Pod中增加一个日志收集容器，使用emtyDir共享日志目录让日志收集程序读取到

应用程序直接推送日志

应用程序直接将日志推送到远程存储上，不经过docker的管理和kubernetes的管理

在K8S中部署ELK

部署elasticsearch

[root@k8s01 yml]# cat elasticsearch.yaml 
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: elasticsearch
  namespace: kube-system
  labels:
    k8s-app: elasticsearch
spec:
  serviceName: elasticsearch
  selector:
    matchLabels:
      k8s-app: elasticsearch
  template:
    metadata:
      labels:
        k8s-app: elasticsearch
    spec:
      containers:
      - image: elasticsearch:7.5.0
        name: elasticsearch
        resources:
          limits:
            cpu: 1
            memory: 2Gi
          requests:
            cpu: 0.5 
            memory: 500Mi
        env:
          - name: "discovery.type"
            value: "single-node"
          - name: ES_JAVA_OPTS
            value: "-Xms512m -Xmx2g" 
        ports:
        - containerPort: 9200
          name: db
          protocol: TCP
        volumeMounts:
        - name: elasticsearch-data
          mountPath: /usr/share/elasticsearch/data
  volumeClaimTemplates:
  - metadata:
      name: elasticsearch-data
    spec:
      storageClassName: "managed-nfs-storage"
      accessModes: [ "ReadWriteOnce" ]
      resources:
        requests:
          storage: 20Gi

---

apiVersion: v1
kind: Service
metadata:
  name: elasticsearch
  namespace: kube-system
spec:
  clusterIP: None
  ports:
  - port: 9200
    protocol: TCP
    targetPort: db
  selector:
    k8s-app: elasticsearch

开始创建

[root@k8s01 yml]# kubectl create -f elasticsearch.yaml 
statefulset.apps/elasticsearch created
service/elasticsearch created
[root@k8s01 yml]# kubectl get pods -n kube-system elasticsearch-0 
NAME              READY   STATUS    RESTARTS   AGE
elasticsearch-0   1/1     Running   0          4m50s
[root@k8s01 yml]# 

部署kibana

[root@k8s01 yml]# cat kibana.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kibana
  namespace: kube-system
  labels:
    k8s-app: kibana
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: kibana
  template:
    metadata:
      labels:
        k8s-app: kibana
    spec:
      containers:
      - name: kibana
        image: kibana:7.5.0
        resources:
          limits:
            cpu: 1
            memory: 500Mi
          requests:
            cpu: 0.5 
            memory: 200Mi
        env:
          - name: ELASTICSEARCH_HOSTS
            value: http://elasticsearch-0.elasticsearch.kube-system:9200
          - name: I18N_LOCALE
            value: zh-CN
        ports:
        - containerPort: 5601
          name: ui
          protocol: TCP

---
apiVersion: v1
kind: Service
metadata:
  name: kibana
  namespace: kube-system
spec:
  type: NodePort
  ports:
  - port: 5601
    protocol: TCP
    targetPort: ui
    nodePort: 30601
  selector:
    k8s-app: kibana

开始创建

[root@k8s01 yml]# kubectl create -f kibana.yaml 
deployment.apps/kibana created
service/kibana created
[root@k8s01 yml]# kubectl get pods -n kube-system kibana-6cd7b9d48b-jrx79 
NAME                      READY   STATUS    RESTARTS   AGE
kibana-6cd7b9d48b-jrx79   1/1     Running   0          3m3s
[root@k8s01 yml]# kubectl get svc -n kube-system kibana 
NAME     TYPE       CLUSTER-IP   EXTERNAL-IP   PORT(S)          AGE
kibana   NodePort   10.0.0.132   <none>        5601:30601/TCP   4m17s
[root@k8s01 yml]# 

filebeat采集标准输出日志

filebeat支持动态的获取容器的日志

[root@k8s01 yml]# cat filebeat-kubernetes.yaml 
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-system
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.config:
      inputs:
        # Mounted `filebeat-inputs` configmap:
        path: ${path.config}/inputs.d/*.yml
        # Reload inputs configs as they change:
        reload.enabled: false
      modules:
        path: ${path.config}/modules.d/*.yml
        # Reload module configs as they change:
        reload.enabled: false

    # To enable hints based autodiscover, remove `filebeat.config.inputs` configuration and uncomment this:
    #filebeat.autodiscover:
    #  providers:
    #    - type: kubernetes
    #      hints.enabled: true

    output.elasticsearch:
      hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-inputs
  namespace: kube-system
  labels:
    k8s-app: filebeat
data:
  kubernetes.yml: |-
    - type: docker
      containers.ids:
      - "*"
      processors:
        - add_kubernetes_metadata:
            in_cluster: true
---
apiVersion: apps/v1 
kind: DaemonSet
metadata:
  name: filebeat
  namespace: kube-system
  labels:
    k8s-app: filebeat
spec:
  selector:
    matchLabels:
      k8s-app: filebeat
  template:
    metadata:
      labels:
        k8s-app: filebeat
    spec:
      serviceAccountName: filebeat
      terminationGracePeriodSeconds: 30
      containers:
      - name: filebeat
        image: elastic/filebeat:7.5.0
        args: [
          "-c", "/etc/filebeat.yml",
          "-e",
        ]
        env:
        - name: ELASTICSEARCH_HOST
          value: elasticsearch-0.elasticsearch.kube-system 
        - name: ELASTICSEARCH_PORT
          value: "9200"
        securityContext:
          runAsUser: 0
          # If using Red Hat OpenShift uncomment this:
          #privileged: true
        resources:
          limits:
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 100Mi
        volumeMounts:
        - name: config
          mountPath: /etc/filebeat.yml
          readOnly: true
          subPath: filebeat.yml
        - name: inputs
          mountPath: /usr/share/filebeat/inputs.d
          readOnly: true
        - name: data
          mountPath: /usr/share/filebeat/data
        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true
      volumes:
      - name: config
        configMap:
          defaultMode: 0600
          name: filebeat-config
      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers
      - name: inputs
        configMap:
          defaultMode: 0600
          name: filebeat-inputs
      # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart
      - name: data
        hostPath:
          path: /var/lib/filebeat-data
          type: DirectoryOrCreate
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: filebeat
subjects:
- kind: ServiceAccount
  name: filebeat
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: filebeat
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: filebeat
  labels:
    k8s-app: filebeat
rules:
- apiGroups: [""] # "" indicates the core API group
  resources:
  - namespaces
  - pods
  verbs:
  - get
  - watch
  - list
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: filebeat
  namespace: kube-system
  labels:
    k8s-app: filebeat

这里指定了es的路径

    output.elasticsearch:
      hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']

这里是一个处理器，他会自动的为日志添加k8s属性。传统配置日志采集工具重要的参数是什么呢？日志路径、日志源、写正则，格式化日志。add_kubernetes_metadata这个处理器可以自动的为k8s添加日志属性信息

data:
  kubernetes.yml: |-
    - type: docker
      containers.ids:
      - "*"
      processors:
        - add_kubernetes_metadata:
            in_cluster: true

这里使用了hostpath挂载了docker的工作目录

      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers

开始创建

[root@k8s01 yml]# kubectl apply -f filebeat-kubernetes.yaml 
configmap/filebeat-config created
configmap/filebeat-inputs created
daemonset.apps/filebeat created
clusterrolebinding.rbac.authorization.k8s.io/filebeat created
clusterrole.rbac.authorization.k8s.io/filebeat created
serviceaccount/filebeat created
[root@k8s01 yml]# kubectl get pods -n kube-system 
NAME                          READY   STATUS    RESTARTS   AGE
coredns-6d8cfdd59d-cbhzg      1/1     Running   0          51m
elasticsearch-0               1/1     Running   0          42m
filebeat-bfd9t                1/1     Running   0          3m15s
filebeat-gbf5f                1/1     Running   0          3m15s
filebeat-sw4z8                1/1     Running   0          3m15s
kibana-6cd7b9d48b-jrx79       1/1     Running   0          35m
kube-flannel-ds-amd64-ghlkp   1/1     Running   1          61m
kube-flannel-ds-amd64-lrq8q   1/1     Running   1          61m
kube-flannel-ds-amd64-vtmf4   1/1     Running   1          61m

起来之后就会自动采集日志

收集日志中落盘的日志文件

收集/var/log/message的日志，在所有node上部署一个filebeat，也就是用daemonsets去部署，挂载宿主机的messages文件到容器，编写配置文件去读message文件就可以了撒，所以YAML文件如下，Configmap和daemonset写到一起了

[root@k8s01 yml]# cat k8s-logs.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8s-logs-filebeat-config
  namespace: kube-system 
  
data:
  filebeat.yml: |
    filebeat.inputs:
      - type: log
        paths:
          - /var/log/messages  
        fields:
          app: k8s 
          type: module 
        fields_under_root: true

    setup.ilm.enabled: false
    setup.template.name: "k8s-module"
    setup.template.pattern: "k8s-module-*"

    output.elasticsearch:
      hosts: ['elasticsearch-0.elasticsearch.kube-system:9200']
      index: "k8s-module-%{+yyyy.MM.dd}"

---

apiVersion: apps/v1
kind: DaemonSet 
metadata:
  name: k8s-logs
  namespace: kube-system
spec:
  selector:
    matchLabels:
      project: k8s 
      app: filebeat
  template:
    metadata:
      labels:
        project: k8s
        app: filebeat
    spec:
      containers:
      - name: filebeat
        image: elastic/filebeat:7.5.0
        args: [
          "-c", "/etc/filebeat.yml",
          "-e",
        ]
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
          limits:
            cpu: 500m
            memory: 500Mi
        securityContext:
          runAsUser: 0
        volumeMounts:
        - name: filebeat-config
          mountPath: /etc/filebeat.yml
          subPath: filebeat.yml
        - name: k8s-logs 
          mountPath: /var/log/messages
      volumes:
      - name: k8s-logs
        hostPath: 
          path: /var/log/messages
      - name: filebeat-config
        configMap:
          name: k8s-logs-filebeat-config

这里主要将宿主机的目录挂载到容器中直接通过filebeat进行收集

        volumeMounts:
        - name: filebeat-config
          mountPath: /etc/filebeat.yml
          subPath: filebeat.yml
        - name: k8s-logs 
          mountPath: /var/log/messages
      volumes:
      - name: k8s-logs
        hostPath: 
          path: /var/log/messages
      - name: filebeat-config
        configMap:
          name: k8s-logs-filebeat-config

开始创建

[root@k8s01 yml]# kubectl apply -f k8s-logs.yaml 
configmap/k8s-logs-filebeat-config created
daemonset.apps/k8s-logs created
[root@k8s01 yml]# 
[root@k8s01 yml]# kubectl get pods -n kube-system 
NAME                          READY   STATUS    RESTARTS   AGE
coredns-6d8cfdd59d-cbhzg      1/1     Running   0          65m
elasticsearch-0               1/1     Running   0          55m
filebeat-bfd9t                1/1     Running   0          16m
filebeat-gbf5f                1/1     Running   0          16m
filebeat-sw4z8                1/1     Running   0          16m
k8s-logs-5q9k6                1/1     Running   0          27s
k8s-logs-7t7jr                1/1     Running   0          27s
k8s-logs-kz8hz                1/1     Running   0          27s
kibana-6cd7b9d48b-jrx79       1/1     Running   0          48m
kube-flannel-ds-amd64-ghlkp   1/1     Running   1          74m
kube-flannel-ds-amd64-lrq8q   1/1     Running   1          74m
kube-flannel-ds-amd64-vtmf4   1/1     Running   1          74m
[root@k8s01 yml]# 

去kibana看一眼，没意外的话会有一个名为k8s-module的索引