k8s集群日志
硬件环境：三台虚拟机，
10.10.20.203 部署docker、etcd、flannel、kube-apiserver、kube-controller-manager、kube-scheduler、elsticsearch、kibana
10.10.20.206 部署docker、flannel、kubelet、kube-proxy、filebeat
10.10.20.207 部署docker、flannel、kubelet、kube-proxy、filebeat
【elsticsearch】
1、下载rpm安装包，wget https://download.elastic.co/elasticsearch/release/org/elasticsearch/distribution/rpm/elasticsearch/2.3.5/elasticsearch-2.3.5.rpm
2、安装，yum localinstall elasticsearch-2.3.5.rpm
3、修改配置文件，vi /etc/elasticsearch/elasticsearch.yml
network.host: 10.10.20.203
4、重启服务
systemctl enable elasticsearch.service
systemctl restart elasticsearch.service
systemctl status elasticsearch.service
【kibana】
1、下载rpm安装包，wget https://download.elastic.co/kibana/kibana/kibana-4.5.4-1.x86_64.rpm
2、安装，yum localinstall kibana-4.5.4-1.x86_64.rpm
3、修改配置文件，vi /opt/kibana/config/kibana.yml
elasticsearch.url: "http://10.10.20.203:9200"
4、重启服务
systemctl enable kibana.service
systemctl restart kibana.service
systemctl status kibana.service
-l
【filebeat】
在需要搜集日志的服务器上安装filebeat
1、下载rpm安装包，wget https://download.elastic.co/beats/filebeat/filebeat-1.2.3-x86_64.rpm
2、安装，yum localinstall filebeat-1.2.3-x86_64.rpm
3、修改配置文件，vi /etc/filebeat/filebeat.yml
filebeat:
prospectors:
-
paths:
- /var/log/messages
input_type: log
document_type: syslog
-
paths:
- /opt/logs/tomcatlog/catalina.*.log
input_type: log
document_type: tomcatlog
-
paths:
- //var/lib/docker/containers/*/*-json.log
input_type: log
document_type: containerlog
registry_file: /var/lib/filebeat/registry
output:
elasticsearch:
hosts: ["10.10.20.203:9200"]
index: "filebeat"
4、重启服务
systemctl enable filebeat
systemctl restart filebeat
systemctl status filebeat
-l
5、访问http://10.10.20.203:5601/，新建filebeat-*这个index，即可查看日志
页:
[1]