更改目录

k8s_yaml/ELK/filebast/filebeat.yaml

@@ -0,0 +1,38 @@
+setup.ilm.enabled: false
+setup.template.enabled: false
+
+filebeat.autodiscover:
+  providers:
+    - type: kubernetes
+      node: ${NODE_NAME}
+      # hints.enabled: false
+      templates:
+      # ---------- go语言的中转服务的Pod, go项目json格式日志 ----------
+        - condition:
+            equals:
+              kubernetes.labels.app: lessie-go-api
+          config:
+            - type: filestream
+              id: "k8s-go-json-log-${data.kubernetes.container.id}"
+              prospector.scanner.symlinks: true
+              close.on_state_change.removed: false
+              parsers:
+                - container: ~
+              paths:
+                - /var/log/containers/*-${data.kubernetes.container.id}.log
+              fields:
+                application: ${data.kubernetes.labels.app}
+                log_type: "goho.log"
+                environment: ${data.kubernetes.labels.environment}
+                instance: ${data.kubernetes.host}
+
+
+# ---- 输出到 Elasticsearch ----
+output.elasticsearch:
+  hosts: ["http://10.0.0.38:9200"]
+  username: "admin"
+  password: "G7ZSKFM4AQwHQpwA"
+  index: "k8s-%{[kubernetes.labels.environment]}-%{[kubernetes.labels.app]}-%{+yyyy.MM.dd}"
+
+logging.level: debug
+logging.selectors: ["autodiscover", "input"]