|NO.Z.00288|——————————|CloudNative|——|KuberNetes&运维.V10|——|EFLK架构.v05|部署logstash|

一、部署logstash

### --- 创建logstash-configmap.yaml
~~~     创建logstash-configmap

[root@k8s-master01 filebeat]# vim logstash-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: logstash-configmap
data:
  logstash.yml: |
    http.host: "0.0.0.0"
    path.config: /usr/share/logstash/pipeline
  logstash.conf: |
    # all input will come from filebeat, no local logs
    input {
      kafka { 
              enable_auto_commit => true 
              auto_commit_interval_ms => "1000"
              bootstrap_servers => "kafka:9092"
              topics => ["test-filebeat"]
              codec => json
          }
    }

    output {
       stdout{ codec=>rubydebug}
       if [fields][pod_namespace] =~ "public-service" {
           elasticsearch {
             hosts => ["elasticsearch-logging:9200"]
             index => "%{[fields][pod_namespace]}-s-%{+YYYY.MM.dd}"
          }
       } else {
          elasticsearch {
             hosts => ["elasticsearch-logging:9200"]
             index => "no-index-%{+YYYY.MM.dd}"
          }
       }
    }

### --- 注：

~~~     # 注释一：
              bootstrap_servers => "kafka"       // kafka的地址，是在同一个namespace下的，若是不在同一个namespace下，需要加入.namespace
              topics => ["test-filebeat"]        // topics

~~~     # 注释二：索引：若是这个namespace等于public-service这个规则，那么就给他新建一个索引
    output {
       stdout{ codec=>rubydebug}
       if [fields][pod_namespace] =~ "public-service" {
           elasticsearch {
             hosts => ["elasticsearch:9200"]
             index => "%{[fields][pod_namespace]}-s-%{+YYYY.MM.dd}"   // 定义的索引的规则
          }   

~~~     # 注释三：索引：若是不是public-service这个namespace下，就打到这个索引下
       } else {
          elasticsearch {
             hosts => ["elasticsearch-logging:9200"]
             index => "no-index-%{+YYYY.MM.dd}"
          }
       } 

二、创建logstash-configmap

### --- 创建logstash-configmap

[root@k8s-master01 filebeat]# kubectl create -f logstash-configmap.yaml -n public-service
configmap/logstash-configmap created

### --- 查看创建的lgostash-configmap

[root@k8s-master01 filebeat]# kubectl get configmap -n public-service -owide
NAME                       DATA   AGE
logstash-configmap         2      46s

三、创建logstash-service.yaml配置文件

### --- 创建logstash-service.yaml文件

[root@k8s-master01 filebeat]# vim logstash-service.yaml
kind: Service
apiVersion: v1
metadata:
  name: logstash-service
spec:
  selector:
    app: logstash
  ports:
  - protocol: TCP
    port: 5044
    targetPort: 5044
  type: ClusterIP

四、创建logstash-service

### --- 创建logstash-service

[root@k8s-master01 filebeat]# kubectl create -f logstash-service.yaml -n public-service
service/logstash-service created

### --- 查看创建的logstash-service

[root@k8s-master01 filebeat]# kubectl get svc,ep -n public-service
NAME                            TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
service/logstash-service        ClusterIP   10.103.104.27    <none>        5044/TCP                     27s

NAME                              ENDPOINTS                                                     AGE
endpoints/logstash-service        <none>                                                        27s

五、创建logstash-deployment.yaml文件

### --- 创建logstash.yaml文件

[root@k8s-master01 filebeat]# vim logstash-deploy.yaml
apiVersion: apps/v1
kind: Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: logstash-deployment
spec:
  selector:
    matchLabels:
      app: logstash
  replicas: 1
  template:
    metadata:
      labels:
        app: logstash
    spec:
      containers:
      - name: logstash
        image: logstash:7.4.2
        ports:
        - containerPort: 5044
        volumeMounts:
          - name: config-volume
            mountPath: /usr/share/logstash/config
          - name: logstash-pipeline-volume
            mountPath: /usr/share/logstash/pipeline
      volumes:
      - name: config-volume
        configMap:
          name: logstash-configmap
          items:
            - key: logstash.yml
              path: logstash.yml
      - name: logstash-pipeline-volume
        configMap:
          name: logstash-configmap
          items:
            - key: logstash.conf
              path: logstash.conf

### --- 注：

~~~     # 注释一：新版本只有V1，没有v1beta1
apiVersion: apps/v1         
~~~     # 注释二：副本数可以起多个，此环境起1个
  replicas: 1

~~~     # 注释三：镜像，和es的对应，若是不对应可能会出现问题的；
~~~     es我们使用的是7.4.2；logstash也用7.4.2
~~~     镜像可以从这2个地址去找

https://hub.docker.com/_/logstash?tab=tags
https://hub.docker.com/r/elastic/filebeat/tags
        image: logstash:7.4.2     // 更改镜像地址

六、创建logstash.deploy

### --- 创建logstash.yaml

[root@k8s-master01 filebeat]# kubectl create -f logstash-deploy.yaml -n public-service
deployment.apps/logstash-deployment created

### --- 查看创建delogstash.yaml

[root@k8s-master01 filebeat]# kubectl get po -n public-service -owide
NAME                                   READY   STATUS    RESTARTS   AGE    IP               NODE           NOMINATED NODE   READINESS GATES
logstash-deployment-78cd865bcd-v6z4t   1/1     Running   0          4m4s   172.25.244.204   k8s-master01   <none>           <none>

---

 

 

 

 

 

 

 

 

 

---

Walter Savage Landor:strove with none,for none was worth my strife.Nature I loved and, next to Nature, Art:I warm'd both hands before the fire of life.It sinks, and I am ready to depart

                                                                                                                                                   ——W.S.Landor

---