赞
踩
1.从官方下载 filebeat-7.13.3-windows-x86_64.zip。
地址:https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.15.2-windows-x86_64.zip
2.解压
Expand-Archive -Path s:/soft/filebeat-7.13.3-windows-x86_64.zip -DestinationPath .
mv filebeat-* filebeat
# escape=`
FROM mcr.microsoft.com/windows/servercore:1909
SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
ENV ES_HOSTS= `
LOGSTASH_HOSTS=
COPY filebeat /filebeat
ENTRYPOINT ["powershell", "C:\\filebeat\\filebeat.exe"]
CMD ["-c /filebeat/filebeat.yml", "-e"]
docker build -t filebeat-w2019:7.13.3 .
--- apiVersion: v1 kind: ConfigMap metadata: name: filebeat-config-w2019 namespace: kube-system labels: k8s-app: filebeat-w2019 data: filebeat.yml: |- filebeat.inputs: - type: container enabled: true paths: - C:\ProgramData\Docker\containers\**\*.log processors: - add_kubernetes_metadata: host: ${NODE_NAME} matchers: - logs_path: logs_path: "C:\\ProgramData\\Docker\\containers" - type: log enabled: true paths: - /var/log/kubelet/kubelet.exe.ERROR - /var/log/kubelet/kubelet.exe.INFO - /var/log/kubelet/kubelet.exe.WARNING # To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this: #filebeat.autodiscover: # providers: # - type: kubernetes # node: ${NODE_NAME} # hints.enabled: true # hints.default_config: # type: container # paths: # - /var/log/containers/*${data.kubernetes.container.id}.log processors: - add_host_metadata: output.elasticsearch: hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}'] username: ${ELASTICSEARCH_USERNAME} password: ${ELASTICSEARCH_PASSWORD} --- apiVersion: apps/v1 kind: DaemonSet metadata: name: filebeat-w2019 namespace: kube-system labels: k8s-app: filebeat-w2019 spec: selector: matchLabels: k8s-app: filebeat-w2019 template: metadata: labels: k8s-app: filebeat-w2019 spec: serviceAccountName: filebeat-w2019 terminationGracePeriodSeconds: 30 hostNetwork: true dnsPolicy: ClusterFirstWithHostNet containers: - name: filebeat-w2019 image: filebeat-w2019:7.13.3 args: [ "--environment=windows_service", "--path.data", "$env:PROGRAMDATA/filebeat/data", "-c", "/etc/filebeat.yml", "-e" ] env: - name: ELASTICSEARCH_HOST value: 192.168.3.150 - name: ELASTICSEARCH_PORT value: "9200" - name: ELASTICSEARCH_USERNAME value: elastic - name: ELASTICSEARCH_PASSWORD value: changeme - name: ELASTIC_CLOUD_ID value: - name: ELASTIC_CLOUD_AUTH value: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName securityContext: # runAsUser: 0 # If using Red Hat OpenShift uncomment this: privileged: true resources: limits: memory: 500Mi requests: cpu: 100m memory: 200Mi volumeMounts: - name: config mountPath: /etc readOnly: true - name: data mountPath: /programdata/filebeat - name: varlibdockercontainers mountPath: /programdata/docker/containers readOnly: true - name: varlog mountPath: /var/log readOnly: true nodeSelector: kubernetes.io/os: windows volumes: - name: config configMap: defaultMode: 0640 name: filebeat-config-w2019 # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart - name: data hostPath: # When filebeat runs as non-root user, this directory needs to be writable by group (g+w). path: /programdata/filebeat type: DirectoryOrCreate - name: varlibdockercontainers hostPath: path: /programdata/docker/containers - name: varlog hostPath: path: /var/log --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: filebeat-w2019 subjects: - kind: ServiceAccount name: filebeat-w2019 namespace: kube-system roleRef: kind: ClusterRole name: filebeat-w2019 apiGroup: rbac.authorization.k8s.io --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: filebeat-w2019 labels: k8s-app: filebeat-w2019 rules: - apiGroups: [""] # "" indicates the core API group resources: - namespaces - pods - nodes verbs: - get - watch - list - apiGroups: ["apps"] resources: - replicasets verbs: ["get", "list", "watch"] --- apiVersion: v1 kind: ServiceAccount metadata: name: filebeat-w2019 namespace: kube-system labels: k8s-app: filebeat-w2019 ---
--- apiVersion: v1 kind: ConfigMap metadata: name: filebeat-config-w2019 namespace: kube-system labels: k8s-app: filebeat-w2019 data: filebeat.yml: |- filebeat.inputs: - type: container enabled: true paths: - C:\ProgramData\Docker\containers\**\*.log processors: - add_kubernetes_metadata: host: ${NODE_NAME} matchers: - logs_path: logs_path: "C:\\ProgramData\\Docker\\containers" - type: log enabled: true paths: - /var/log/kubelet/kubelet.exe.ERROR - /var/log/kubelet/kubelet.exe.INFO - /var/log/kubelet/kubelet.exe.WARNING # To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this: #filebeat.autodiscover: # providers: # - type: kubernetes # node: ${NODE_NAME} # hints.enabled: true # hints.default_config: # type: container # paths: # - /var/log/containers/*${data.kubernetes.container.id}.log processors: - add_host_metadata: output.elasticsearch: hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}'] username: ${ELASTICSEARCH_USERNAME} password: ${ELASTICSEARCH_PASSWORD} --- apiVersion: apps/v1 kind: DaemonSet metadata: name: filebeat-w2019 namespace: kube-system labels: k8s-app: filebeat-w2019 spec: selector: matchLabels: k8s-app: filebeat-w2019 template: metadata: labels: k8s-app: filebeat-w2019 spec: serviceAccountName: filebeat-w2019 terminationGracePeriodSeconds: 30 hostNetwork: true dnsPolicy: ClusterFirstWithHostNet containers: - name: filebeat-w2019 image: filebeat-w2019:7.13.3 args: [ "--environment=windows_service", "--path.data", "$env:PROGRAMDATA/filebeat/data", "-c", "/etc/filebeat.yml", "-e" ] env: - name: ELASTICSEARCH_HOST value: 192.168.3.150 - name: ELASTICSEARCH_PORT value: "9200" - name: ELASTICSEARCH_USERNAME value: elastic - name: ELASTICSEARCH_PASSWORD value: changeme - name: ELASTIC_CLOUD_ID value: - name: ELASTIC_CLOUD_AUTH value: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName securityContext: # runAsUser: 0 # If using Red Hat OpenShift uncomment this: privileged: true resources: limits: memory: 500Mi requests: cpu: 100m memory: 200Mi volumeMounts: - name: config mountPath: /etc readOnly: true - name: data mountPath: /programdata/filebeat - name: varlibdockercontainers mountPath: /programdata/docker/containers readOnly: true - name: varlog mountPath: /var/log readOnly: true nodeSelector: kubernetes.io/os: windows volumes: - name: config configMap: defaultMode: 0640 name: filebeat-config-w2019 # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart - name: data hostPath: # When filebeat runs as non-root user, this directory needs to be writable by group (g+w). path: /programdata/filebeat type: DirectoryOrCreate - name: varlibdockercontainers hostPath: path: d:/docker-root/containers - name: varlog hostPath: path: /var/log --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: filebeat-w2019 subjects: - kind: ServiceAccount name: filebeat-w2019 namespace: kube-system roleRef: kind: ClusterRole name: filebeat-w2019 apiGroup: rbac.authorization.k8s.io --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: filebeat-w2019 labels: k8s-app: filebeat-w2019 rules: - apiGroups: [""] # "" indicates the core API group resources: - namespaces - pods - nodes verbs: - get - watch - list - apiGroups: ["apps"] resources: - replicasets verbs: ["get", "list", "watch"] --- apiVersion: v1 kind: ServiceAccount metadata: name: filebeat-w2019 namespace: kube-system labels: k8s-app: filebeat-w2019 ---
Copyright © 2003-2013 www.wpsshop.cn 版权所有,并保留所有权利。