简介
通过sidecar方法进行接入，与提供日志的容器部署在同一个pod里，主要是配置statefulset里的containers和configmap里的filebeat.yaml
1.把nginx的日志文件挂载在access_log这个volume里，同时在filebeat这个pod里也挂载access_log这个volume
2.filebeat通过subpath的方法挂载单独一个filebeat.yml到/usr/share/filebeat/filebeat.yml。注意，如果不用subpath挂载单个文件的话，是会覆盖掉/usr/share/filebeat/目录的
3.configmap里设置elasticsearch的地址和index，指定日志文件
statefulset.yaml
containers: - image: nginx:latest name: nginx ports: - containerPort: 80 volumeMounts: - name: access-log #日志同时挂载在nginx和filebeat中 mountPath: /var/log/nginx/ - image: docker.elastic.co/beats/filebeat:6.8.12 imagePullPolicy: Always name: filebeat volumeMounts: - name: access-log #日志同时挂载在nginx和filebeat中 mountPath: /log - name: filebeat-config mountPath: /usr/share/filebeat/filebeat.yml subPath: filebeat.yml volumes: - name: filebeat-config configMap: name: filebeat-config items: - key: filebeat.yml path: filebeat.yml
configmap.yaml
--- apiVersion: v1 kind: ConfigMap metadata: name: filebeat-config data: filebeat.yml: | filebeat.inputs: - type: log paths: - "/log/access.log" setup.template.name: "filebeat" setup.template.pattern: "filebeat-*" output.elasticsearch: hosts: ["{{ .Values.elastricsearch.addr }}"] index: "frontend-filebeat"