k8s集群日志

硬件环境：

三台虚拟机，

10.10.20.203 部署docker、etcd、flannel、kube-apiserver、kube-controller-manager、kube-scheduler、elsticsearch、kibana

10.10.20.206 部署docker、flannel、kubelet、kube-proxy、filebeat

10.10.20.207 部署docker、flannel、kubelet、kube-proxy、filebeat

【elsticsearch】

1、下载rpm安装包，wget https://download.elastic.co/elasticsearch/release/org/elasticsearch/distribution/rpm/elasticsearch/2.3.5/elasticsearch-2.3.5.rpm

2、安装，yum localinstall elasticsearch-2.3.5.rpm

3、修改配置文件，vi /etc/elasticsearch/elasticsearch.yml

network.host: 10.10.20.203

4、重启服务

systemctl enable elasticsearch.service
systemctl restart elasticsearch.service
systemctl status elasticsearch.service

【kibana】

1、下载rpm安装包，wget https://download.elastic.co/kibana/kibana/kibana-4.5.4-1.x86_64.rpm

2、安装，yum localinstall kibana-4.5.4-1.x86_64.rpm

3、修改配置文件，vi /opt/kibana/config/kibana.yml

elasticsearch.url: "http://10.10.20.203:9200"

4、重启服务

systemctl enable kibana.service
systemctl restart kibana.service
systemctl status kibana.service -l

【filebeat】

在需要搜集日志的服务器上安装filebeat

1、下载rpm安装包，wget https://download.elastic.co/beats/filebeat/filebeat-1.2.3-x86_64.rpm

2、安装，yum localinstall filebeat-1.2.3-x86_64.rpm

3、修改配置文件，vi /etc/filebeat/filebeat.yml

filebeat:
  prospectors:
    -
      paths:
        - /var/log/messages
      input_type: log
      document_type: syslog
    -
      paths:
        - /opt/logs/tomcatlog/catalina.*.log
      input_type: log
      document_type: tomcatlog
    -
      paths:
        - //var/lib/docker/containers/*/*-json.log
      input_type: log
      document_type: containerlog
  registry_file: /var/lib/filebeat/registry

output:
  elasticsearch:
    hosts: ["10.10.20.203:9200"]
    index: "filebeat"

4、重启服务

systemctl enable filebeat
systemctl restart filebeat
systemctl status filebeat -l

5、访问http://10.10.20.203:5601/，新建filebeat-*这个index，即可查看日志