94 lines
3.4 KiB
YAML
94 lines
3.4 KiB
YAML
apiVersion: v1
|
||
kind: ConfigMap
|
||
metadata:
|
||
name: filebeat-config
|
||
namespace: kube-system
|
||
data:
|
||
filebeat.yml: |
|
||
setup.ilm.enabled: false
|
||
setup.template.enabled: false
|
||
|
||
filebeat.autodiscover:
|
||
providers:
|
||
- type: kubernetes
|
||
node: ${NODE_NAME}
|
||
hints.enabled: false
|
||
|
||
templates:
|
||
# ---------- Template 1: java语言的admin、agent、payment Pod, java21项目多行堆栈文本日志 ----------
|
||
- condition:
|
||
equals:
|
||
kubernetes.namespace: "sit" # 假设你的业务 pod 在 sit 命名空间
|
||
# or:
|
||
# - equals:
|
||
# kubernetes.labels.app: "flymoon-admin"
|
||
# - equals:
|
||
# kubernetes.labels.app: "flymoon-agent"
|
||
# - equals:
|
||
# kubernetes.labels.app: "flymoon-payment"
|
||
config:
|
||
- type: filestream
|
||
id: "k8s-log-${data.kubernetes.container.id}"
|
||
prospector.scanner.symlinks: true
|
||
parsers:
|
||
- container: ~
|
||
paths:
|
||
- /var/log/containers/*-${data.kubernetes.container.id}.log
|
||
# multiline:
|
||
# pattern: '^\d{4}-\d{2}-\d{2}-\d{2}:\d{2}:\d{2}\.\d{3}'
|
||
# negate: true
|
||
# match: after
|
||
# ignore_older: 24h
|
||
# scan_frequency: 10s
|
||
# clean_inactive: 25h
|
||
# close_inactive: 5m
|
||
# close_renamed: true
|
||
# start_position: beginning
|
||
fields:
|
||
application: ${data.kubernetes.labels.app}
|
||
log_type: ${data.kubernetes.labels.log_type}
|
||
environment: ${data.kubernetes.labels.environment}
|
||
instance: ${data.kubernetes.host}
|
||
|
||
processors:
|
||
- add_kubernetes_metadata:
|
||
host: ${NODE_NAME}
|
||
- add_fields:
|
||
fields:
|
||
log_source: k8s
|
||
target: 'mylog'
|
||
- dissect:
|
||
tokenizer: "%{timestamp} [%{thread}] %{level} %{class} - [%{method},%{line}] - %{message}"
|
||
field: "message"
|
||
target_prefix: "mylog"
|
||
ignore_missing: true
|
||
overwrite_keys: true
|
||
|
||
# ---------- java语言的email服务的Pod, java1.8项目自由文本格式日志, java21项目格式不太一样, 但也有堆栈信息----------
|
||
|
||
|
||
# ---------- go语言的中转服务的Pod, go项目json格式日志 ----------
|
||
|
||
|
||
# ---------- python语言的lessie-agent的Pod, python项目只有文本格式日志, 需排除掉一些不采集的日志 ----------
|
||
|
||
|
||
# ---------- python语言的apex的Pod, python项目json格式日志 ----------
|
||
|
||
|
||
# ---------- 前端存储静态资源的nginx pod, nginx 格式日志 ----------
|
||
|
||
|
||
# ---- 输出到 Elasticsearch ----
|
||
output.elasticsearch:
|
||
hosts: ["http://10.0.0.38:9200"]
|
||
username: "admin"
|
||
password: "G7ZSKFM4AQwHQpwA"
|
||
|
||
# 动态索引命名：k8s-环境-应用-日期
|
||
index: "k8s-%{[kubernetes.labels.environment]}-%{[kubernetes.labels.app]}-%{+yyyy.MM.dd}"
|
||
|
||
|
||
logging.level: debug
|
||
logging.selectors: ["*"]
|