实战Elastic Stack分析K8S应用日志--部署logstash

logstash从kafka取数据输出到es

部署logstash

~]# docker pull logstash:6.8.6
~]# docker images|grep logstash
~]# docker tag d0a2dac51fcb harbor.od.com/infra/logstash:v6.8.6
~]# docker push harbor.od.com/infra/logstash:v6.8.6
~]# mkdir /etc/logstash
vi /etc/logstash/logstash-test.conf

input {
  kafka {
    bootstrap_servers => "10.4.7.12:9092"
    client_id => "10.4.7.200"
    consumer_threads => 4
    group_id => "k8s_test"
    topics_pattern => "k8s-fb-test-.*"
  }
}

filter {
  json {
    source => "message"
  }
}

output {
  elasticsearch {
    hosts => ["10.4.7.21:9200"]
    index => "k8s-test-%{+YYYY.MM.DD}"
  }
}

启动

~]# docker run -d --name logstash-test -v /etc/logstash:/etc/logstash harbor.od.com/infra/logstash:v6.8.6 -f /etc/logstash/logstash-test.conf
~]# docker ps -a|grep logstash

列出es索引

[root@node7-21 ~]# curl http://10.4.7.21:9200/_cat/indices?v

health status index                uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   k8s-test-2021.09.245 mnyjaOTRTFyKrjUA4x8dDA   5   0         12            0    104.8kb        104.8kb