更改目录

k8s_yaml/ELK/filebast/022-filebeat-configmap.yaml

@@ -10,29 +10,48 @@ data:
 
     filebeat.autodiscover:
       providers:
-        # 配置 Provider
         - type: kubernetes
-          node: ${NODE_NAME}
-          hints.enabled: false
-      
           templates:
-            # ---------- go语言的中转服务的Pod, go项目json格式日志 ----------
+            # ---------- ↓ go语言的中转服务的Pod, go项目json格式日志 ↓ ----------
             - condition:
-                equals:
-                  kubernetes.namespace: kube-system
+                and:
+                  - equals:
+                      kubernetes.namespace: sit
+                  - equals:
+                      kubernetes.labels.app: "lessie-go-api"
               config:
                 - type: filestream
-                  id: "k8s-go-json-log-${data.kubernetes.container.id}"
+                  id: "container-${data.kubernetes.container.id}"
                   prospector.scanner.symlinks: true
+                  close.on_state_change.removed: false
                   parsers:
                     - container: ~
                   paths:
                     - /var/log/containers/*-${data.kubernetes.container.id}.log
-                  fields:
-                    application: ${data.kubernetes.labels.app}
-                    log_type: "goho.log"
-                    environment: ${data.kubernetes.labels.environment}
-                    instance: ${data.kubernetes.host}
+
+                  processors:
+                    - add_kubernetes_metadata:
+                        host: ${NODE_NAME}
+                        include_fields:
+                          - "kubernetes.node.hostname"
+                          - "kubernetes.container.name"
+                          - "kubernetes.pod.name"
+                          - "kubernetes.pod.ip"
+                          - "kubernetes.namespace"
+                          - "kubernetes.labels.app"
+                          - "kubernetes.labels.environment"
+                          - "kubernetes.labels.project"
+
+                    - decode_json_fields:
+                        fields: ["message"]
+                        target: "mylog"
+                        overwrite_keys: true
+                        add_error_key: true
+
+                    - drop_fields:
+                      fields:
+                        - ""
+
 
 
     # ---- 输出到 Elasticsearch ----
@@ -41,6 +60,7 @@ data:
       username: "admin"
       password: "G7ZSKFM4AQwHQpwA"
       index: "k8s-%{[kubernetes.labels.environment]}-%{[kubernetes.labels.app]}-%{+yyyy.MM.dd}"
+      # index: "k8s-%{[kubernetes.labels.app]}-%{+yyyy.MM.dd}"
 
     logging.level: debug
-    logging.selectors: ["*"]
+    logging.selectors:  ["*"]