本文的环境介绍

[root@m-30-1 ~]# kubectl version
Client Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.2", GitCommit:"81753b10df112992bf51bbc2c2f85208aad78335", GitTreeState:"clean", BuildDate:"2018-04-27T09:22:21Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.2", GitCommit:"81753b10df112992bf51bbc2c2f85208aad78335", GitTreeState:"clean", BuildDate:"2018-04-27T09:10:24Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
[root@m-30-1 ~]# rpm -qf /etc/issue
centos-release-7-4.1708.el7.centos.x86_64

kubernetes集群是通过kubeadm安装的，filebeat版本为6.2.4

具体配置文件如下：

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.prospectors:
    - type: log
      paths:
        - /logdata/*.log
      tail_files: true
      fields:
        pod_name: '${pod_name}'
        POD_IP: '${POD_IP}'
    output.file:
      path: "/tmp/filebeat"
      filename: filebeat
      codec.format:
        string: '%{[@timestamp]} %{[message]} pod_name %{[fields][pod_name]} %{[fields][POD_IP]}'

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-test-config
  labels:
    k8s-app: nginx-test-config
data:
  nginx-test-config: |-
    server {
        listen       80;
        server_name  localhost;
        access_log  /logdata/access.log  main;
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
    }

---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: nginx-prod
  labels:
    app: nginx-log
spec:
  template:
    metadata:
      labels:
        app: nginx-log
    spec:
      containers:
      - image: nginx
        name: nginx
        ports:
        - containerPort: 80
          protocol: TCP
        resources: {}
        volumeMounts:
        - name: logdata
          mountPath: /logdata
        - name: nginx-test-config
          mountPath:  /etc/nginx/conf.d/
      - name: filebeat
        image: docker.elastic.co/beats/filebeat:6.2.4
        args: [
          "-c", "/opt/filebeat/filebeat.yml",
          "-e",
        ]
        env:
        - name: POD_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: pod_name
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        securityContext:
          runAsUser: 0
        resources:
          limits:
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 100Mi
        volumeMounts:
        - name: config
          mountPath: /opt/filebeat/
        - name: data
          mountPath: /usr/share/filebeat/data
        - name: logdata
          mountPath: /logdata
      volumes:
      - name: nginx-test-config
        configMap:
          name: nginx-test-config
          items:
          - key: nginx-test-config
            path: test.conf
      - name: logdata
        emptyDir: {}
      - name: config
        configMap:
          name: filebeat-config
          items:
          - key: filebeat.yml
            path: filebeat.yml
      - name: data
        emptyDir: {}