devbox
我家小花儿
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

在k8s集群部署ELK

作者：我家小花儿 | 2024-08-07 21:50:15

赞

踩

在k8s集群部署ELK

使用kubeadm或者其他方式部署一套k8s集群。

在k8s集群创建一个namespace：halashow

2 ELK部署架构

3.1 准备资源配置清单

 Deployment中存在一个es的业务容器，和一个init容器，init容器主要是配置vm.max_map_count=262144。

service暴露了9200端口，其他服务可通过service name加端口访问es。

3.1 准备资源配置清单

 Deployment中存在一个es的业务容器，和一个init容器，init容器主要是配置vm.max_map_count=262144。

service暴露了9200端口，其他服务可通过service name加端口访问es。

  1. apiVersion: v1
  2. kind: Service
  3. metadata:
  4.   namespace: halashow
  5.   name: elasticsearch
  6.   labels:
  7.     app: elasticsearch-logging
  8. spec:
  9.   type: ClusterIP
  10.   ports:
  11.   - port: 9200
  12.     name: elasticsearch  
  13.   selector: 
  14.     app: elasticsearch-logging
  15. ---
  16. apiVersion: apps/v1
  17. kind: Deployment
  18. metadata:
  19.   generation: 1
  20.   labels:
  21.     app: elasticsearch-logging
  22.     version: v1
  23.   name: elasticsearch
  24.   namespace: halashow
  25. spec:
  26.   serviceName: elasticsearch-logging
  27.   minReadySeconds: 10
  28.   progressDeadlineSeconds: 600
  29.   replicas: 1
  30.   revisionHistoryLimit: 10
  31.   selector:
  32.     matchLabels:
  33.       app: elasticsearch-logging
  34.       version: v1
  35.   strategy:
  36.     type: Recreate
  37.   template:
  38.     metadata:
  39.       creationTimestamp: null
  40.       labels:
  41.         app: elasticsearch-logging
  42.         version: v1
  43.     spec:
  44.       affinity:
  45.         nodeAffinity: {}
  46.       containers:
  47.       - env:
  48.         - name: discovery.type
  49.           value: single-node
  50.         - name: ES_JAVA_OPTS
  51.           value: -Xms512m -Xmx512m
  52.         - name: MINIMUM_MASTER_NODES
  53.           value: "1"
  54.         image: docker.elastic.co/elasticsearch/elasticsearch:7.12.0-amd64
  55.         imagePullPolicy: IfNotPresent
  56.         name: elasticsearch-logging
  57.         ports:
  58.         - containerPort: 9200
  59.           name: db
  60.           protocol: TCP
  61.         - containerPort: 9300
  62.           name: transport
  63.           protocol: TCP
  64.         resources:
  65.           limits:
  66.             cpu: "1"
  67.             memory: 1Gi
  68.           requests:
  69.             cpu: "1"
  70.             memory: 1Gi
  71.         terminationMessagePath: /dev/termination-log
  72.         terminationMessagePolicy: File
  73.         volumeMounts:
  74.         - mountPath: /data
  75.           name: es-persistent-storage
  76.       dnsPolicy: ClusterFirst
  77.       imagePullSecrets:
  78.       - name: user-1-registrysecret
  79.       initContainers:
  80.       - command:
  81.         - /sbin/sysctl
  82.         - -w
  83.         - vm.max_map_count=262144
  84.         image: alpine:3.6
  85.         imagePullPolicy: IfNotPresent
  86.         name: elasticsearch-logging-init
  87.         resources: {}
  88.         securityContext:
  89.           privileged: true
  90.           procMount: Default
  91.         terminationMessagePath: /dev/termination-log
  92.         terminationMessagePolicy: File
  93.       restartPolicy: Always
  94.       schedulerName: default-scheduler
  95.       securityContext: {}
  96.       terminationGracePeriodSeconds: 30
  97.       volumes:
  98.       - hostPath:
  99.           path: /data/elk/elasticsearch-logging
  100.           type: DirectoryOrCreate
  101.         name: es-persistent-storage
  102.       nodeSelector:
  103.         alibabacloud.com/is-edge-worker: 'false'
  104.         beta.kubernetes.io/arch: amd64
  105.         beta.kubernetes.io/os: linux
  106.       tolerations:
  107.         - effect: NoSchedule
  108.           key: node-role.alibabacloud.com/addon
  109.           operator: Exists

elasticsearch持久化部署，参考资料

https://www.51cto.com/article/673023.html
  1.  
  2. apiVersion: v1
  3. kind: Service
  4. metadata:
  5.   name: es
  6.   namespace: default
  7.   labels:
  8.     k8s-app: es
  9.     kubernetes.io/cluster-service: "true"
  10.     addonmanager.kubernetes.io/mode: Reconcile
  11.     kubernetes.io/name: "Elasticsearch"
  12. spec:
  13.   ports:
  14.   - port: 9200
  15.     protocol: TCP
  16.     targetPort: db
  17.   selector:
  18.     k8s-app: es
  19. ---
  20. # RBAC authn and authz
  21. apiVersion: v1
  22. kind: ServiceAccount
  23. metadata:
  24.   name: es
  25.   namespace: default
  26.   labels:
  27.     k8s-app: es
  28.     kubernetes.io/cluster-service: "true"
  29.     addonmanager.kubernetes.io/mode: Reconcile
  30. ---
  31. kind: ClusterRole
  32. apiVersion: rbac.authorization.k8s.io/v1
  33. metadata:
  34.   name: es
  35.   labels:
  36.     k8s-app: es
  37.     kubernetes.io/cluster-service: "true"
  38.     addonmanager.kubernetes.io/mode: Reconcile
  39. rules:
  40. - apiGroups:
  41.   - ""
  42.   resources:
  43.   - "services"
  44.   - "namespaces"
  45.   - "endpoints"
  46.   verbs:
  47.   - "get"
  48. ---
  49. kind: ClusterRoleBinding
  50. apiVersion: rbac.authorization.k8s.io/v1
  51. metadata:
  52.   namespace: default
  53.   name: es
  54.   labels:
  55.     k8s-app: es
  56.     kubernetes.io/cluster-service: "true"
  57.     addonmanager.kubernetes.io/mode: Reconcile
  58. subjects:
  59. - kind: ServiceAccount
  60.   name: es
  61.   namespace: default
  62.   apiGroup: ""
  63. roleRef:
  64.   kind: ClusterRole
  65.   name: es
  66.   apiGroup: ""
  67. ---
  68. # Elasticsearch deployment itself
  69. apiVersion: apps/v1
  70. kind: StatefulSet #使用statefulset创建Pod
  71. metadata:
  72.   name: es #pod名称,使用statefulSet创建的Pod是有序号有顺序的
  73.   namespace: default  #命名空间
  74.   labels:
  75.     k8s-app: es
  76.     kubernetes.io/cluster-service: "true"
  77.     addonmanager.kubernetes.io/mode: Reconcile
  78.     srv: srv-elasticsearch
  79. spec:
  80.   serviceName: es #与svc相关联，这可以确保使用以下DNS地址访问Statefulset中的每个pod (es-cluster-[0,1,2].elasticsearch.elk.svc.cluster.local)
  81.   replicas: 1 #副本数量,单节点
  82.   selector:
  83.     matchLabels:
  84.       k8s-app: es #和pod template配置的labels相匹配
  85.   template:
  86.     metadata:
  87.       labels:
  88.         k8s-app: es
  89.         kubernetes.io/cluster-service: "true"
  90.     spec:
  91.       serviceAccountName: es
  92.       containers:
  93.       - image: docker.io/library/elasticsearch:7.10.1
  94.         name: es
  95.         resources:
  96.           # need more cpu upon initialization, therefore burstable class
  97.           limits:
  98.             cpu: 1000m
  99.             memory: 2Gi
  100.           requests:
  101.             cpu: 100m
  102.             memory: 500Mi
  103.         ports:
  104.         - containerPort: 9200
  105.           name: db
  106.           protocol: TCP
  107.         - containerPort: 9300
  108.           name: transport
  109.           protocol: TCP
  110.         volumeMounts:
  111.         - name: es
  112.           mountPath: /usr/share/elasticsearch/data/   #挂载点
  113.         env:
  114.         - name: "NAMESPACE"
  115.           valueFrom:
  116.             fieldRef:
  117.               fieldPath: metadata.namespace
  118.         - name: "discovery.type"  #定义单节点类型
  119.           value: "single-node"
  120.         - name: ES_JAVA_OPTS #设置Java的内存参数，可以适当进行加大调整
  121.           value: "-Xms1024m -Xmx4g" 
  122.       volumes:
  123.       - name: es
  124.         hostPath:
  125.           path: /data/es/
  126.       nodeSelector: #如果需要匹配落盘节点可以添加nodeSelect
  127.         es: data
  128.       tolerations:
  129.       - effect: NoSchedule
  130.         operator: Exists
  131.       # Elasticsearch requires vm.max_map_count to be at least 262144.
  132.       # If your OS already sets up this number to a higher value, feel free
  133.       # to remove this init container.
  134.       initContainers: #容器初始化前的操作
  135.       - name: es-init
  136.         image: alpine:3.6
  137.         command: ["/sbin/sysctl", "-w", "vm.max_map_count=262144"] #添加mmap计数限制，太低可能造成内存不足的错误
  138.         securityContext:  #仅应用到指定的容器上，并且不会影响Volume
  139.           privileged: true #运行特权容器
  140.       - name: increase-fd-ulimit
  141.         image: busybox
  142.         imagePullPolicy: IfNotPresent
  143.         command: ["sh", "-c", "ulimit -n 65536"] #修改文件描述符最大数量
  144.         securityContext:
  145.           privileged: true
  146.       - name: elasticsearch-volume-init #es数据落盘初始化，加上777权限
  147.         image: alpine:3.6
  148.         command:
  149.           - chmod
  150.           - -R
  151.           - "777"
  152.           - /usr/share/elasticsearch/data/
  153.         volumeMounts:
  154.         - name: es
  155.           mountPath: /usr/share/elasticsearch/data/
  156.  
  157.  
  158. ---
  159.  
  160. apiVersion: v1
  161. kind: Service
  162. metadata:
  163.   name: kibana
  164.   namespace: default
  165.   labels:
  166.     k8s-app: kibana
  167.     kubernetes.io/cluster-service: "true"
  168.     addonmanager.kubernetes.io/mode: Reconcile
  169.     kubernetes.io/name: "Kibana"
  170.     srv: srv-kibana
  171. spec:
  172.   type: NodePort #采用nodeport方式进行暴露，端口默认为25601
  173.   ports:
  174.   - port: 5601
  175.     nodePort: 30561
  176.     protocol: TCP
  177.     targetPort: ui
  178.   selector:
  179.     k8s-app: kibana
  180. ---
  181. apiVersion: apps/v1
  182. kind: Deployment
  183. metadata:
  184.   name: kibana
  185.   namespace: default
  186.   labels:
  187.     k8s-app: kibana
  188.     kubernetes.io/cluster-service: "true"
  189.     addonmanager.kubernetes.io/mode: Reconcile
  190.     srv: srv-kibana
  191. spec:
  192.   replicas: 1
  193.   selector:
  194.     matchLabels:
  195.       k8s-app: kibana
  196.   template:
  197.     metadata:
  198.       labels:
  199.         k8s-app: kibana
  200.       annotations:
  201.         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
  202.     spec:
  203.       containers:
  204.       - name: kibana
  205.         image: docker.io/kubeimages/kibana:7.9.3 #该镜像支持arm64和amd64两种架构
  206.         resources:
  207.           # need more cpu upon initialization, therefore burstable class
  208.           limits:
  209.             cpu: 1000m
  210.           requests:
  211.             cpu: 100m
  212.         env:
  213.           - name: ELASTICSEARCH_HOSTS
  214.             value: http://es:9200
  215.         ports:
  216.         - containerPort: 5601
  217.           name: ui
  218.           protocol: TCP
  219. ---
  220. apiVersion: extensions/v1beta1
  221. kind: Ingress
  222. metadata:
  223.   name: kibana
  224.   namespace: yk-mysql-test
  225. spec:
  226.   rules:
  227.   - host: kibana.ctnrs.com
  228.     http:
  229.       paths:
  230.       - path: /
  231.         backend:
  232.           serviceName: kibana
  233.           servicePort: 5601
  234.

 4 部署logstash

创建configMap定义logstash相关配置项，主要包括一下几项。

　　input：定义输入到logstash的源。

　　filter：定义过滤条件。

　　output：可以定义输出到es，redis，kafka等等。

  1. ---
  2. apiVersion: v1
  3. kind: ConfigMap
  4. metadata:
  5.   name: logstash-config
  6.   namespace: halashow
  7. data:
  8.   logstash.conf: |-
  9.  
  10.     input {
  11.         redis {
  12.             host => "10.36.21.220"
  13.             port => 30079
  14.             db => 0
  15.             key => "localhost"
  16.             password => "123456"
  17.             data_type => "list"
  18.             threads => 4
  19.             batch_count => "1"
  20.             #tags => "user.log"
  21.         }
  22.      
  23.     }
  24.      
  25.     filter {
  26.       dissect {
  27.         mapping => { "message" => "[%{Time}] %{LogLevel} %{message}" }
  28.       }
  29.     }
  30.      
  31.     output {
  32.       if "nginx.log" in [tags] {
  33.         elasticsearch {
  34.           hosts => ["elasticsearch:9200"]
  35.           index => "nginx.log"
  36.         }
  37.       }
  38.  
  39.        if "osale-uc-test" in [tags] {
  40.         elasticsearch {
  41.           hosts => ["elasticsearch:9200"]
  42.           index => "osale-uc-test"
  43.         }
  44.       }
  45.        if "osale-jindi-client-test" in [tags] {
  46.         elasticsearch {
  47.           hosts => ["elasticsearch:9200"]
  48.           index => "osale-jindi-client-test"
  49.         }
  50.       }
  51.       if "osale-admin-weixin" in [tags] {
  52.         elasticsearch {
  53.           hosts => ["elasticsearch:9200"]
  54.           index => "osale-admin-weixin"
  55.         }
  56.       }
  57.     }
  58.  
  59.  
  60. ---
  61. apiVersion: apps/v1
  62. kind: Deployment
  63. metadata:
  64.   name: logstash
  65.   namespace: halashow
  66.   labels: 
  67.     name: logstash
  68. spec:
  69.   replicas: 1
  70.   selector:
  71.     matchLabels: 
  72.       name: logstash
  73.   template:
  74.     metadata:
  75.       labels: 
  76.         app: logstash
  77.         name: logstash
  78.     spec:
  79.       containers:
  80.       - name: logstash
  81.         image: docker.elastic.co/logstash/logstash:7.12.0
  82.         ports:
  83.         - containerPort: 5044
  84.           protocol: TCP
  85.         - containerPort: 9600
  86.           protocol: TCP
  87.  
  88.         volumeMounts:
  89.         - name: logstash-config
  90.           #mountPath: /usr/share/logstash/logstash-simple.conf
  91.           #mountPath: /usr/share/logstash/config/logstash-sample.conf
  92.           mountPath: /usr/share/logstash/pipeline/logstash.conf
  93.           subPath: logstash.conf
  94.         #ports:
  95.         #  - containerPort: 80
  96.         #    protocol: TCP
  97.  
  98.  
  99.       volumes:
  100.       - name: logstash-config
  101.         configMap:
  102.           #defaultMode: 0644
  103.           name: logstash-config
  104.  
  105. ---
  106. apiVersion: v1
  107. kind: Service
  108. metadata:
  109.   namespace: halashow
  110.   name: logstash
  111.   labels:
  112.     app: logstash
  113. spec:
  114.   type: ClusterIP
  115.   ports:
  116.   - port: 5044
  117.     name: logstash
  118.   selector: 
  119.     app: logstash

5.部署redis5.0 

  1. apiVersion: v1 
  2. kind: ConfigMap 
  3. metadata: 
  4.   name: elk-redis
  5.   labels: 
  6.     app: elk-redis
  7. data: 
  8.   redis.conf: |-
  9.     bind 0.0.0.0
  10.     daemonize no
  11.     pidfile "/var/run/redis.pid"
  12.     port 6380
  13.     timeout 300
  14.     loglevel warning
  15.     logfile "redis.log"
  16.     databases 16
  17.     rdbcompression yes
  18.     dbfilename "redis.rdb"
  19.     dir "/data"
  20.     requirepass "123456"
  21.     masterauth "123456"
  22.     maxclients 10000
  23.     maxmemory 1000mb
  24.     maxmemory-policy allkeys-lru
  25.     appendonly yes
  26.     appendfsync always
  27. ---
  28. apiVersion: apps/v1 
  29. kind: StatefulSet 
  30. metadata: 
  31.   name: elk-redis 
  32.   labels: 
  33.     app: elk-redis 
  34. spec:
  35.   replicas: 1 
  36.   selector: 
  37.     matchLabels: 
  38.       app: elk-redis 
  39.   template: 
  40.     metadata: 
  41.       labels: 
  42.         app: elk-redis 
  43.     spec: 
  44.       containers: 
  45.       - name: redis 
  46.         image: redis:5.0.7 
  47.         command: 
  48.           - "sh" 
  49.           - "-c" 
  50.           - "redis-server /usr/local/redis/redis.conf" 
  51.         ports: 
  52.         - containerPort: 6379 
  53.         resources: 
  54.           limits: 
  55.             cpu: 1000m 
  56.             memory: 1024Mi 
  57.           requests: 
  58.             cpu: 1000m 
  59.             memory: 1024Mi 
  60.         livenessProbe: 
  61.           tcpSocket: 
  62.             port: 6379 
  63.           initialDelaySeconds: 300 
  64.           timeoutSeconds: 1 
  65.           periodSeconds: 10 
  66.           successThreshold: 1 
  67.           failureThreshold: 3 
  68.         readinessProbe: 
  69.           tcpSocket: 
  70.             port: 6379 
  71.           initialDelaySeconds: 5 
  72.           timeoutSeconds: 1 
  73.           periodSeconds: 10 
  74.           successThreshold: 1 
  75.           failureThreshold: 3 
  76.         volumeMounts:
  77.         - name: data
  78.           mountPath: /data
  79.         # 时区设置
  80.         - name: timezone
  81.           mountPath: /etc/localtime
  82.         - name: config 
  83.           mountPath:  /usr/local/redis/redis.conf 
  84.           subPath: redis.conf 		  
  85.       volumes:
  86.       - name: config 
  87.         configMap: 
  88.           name: elk-redis
  89.       - name: timezone                             
  90.         hostPath:
  91.           path: /usr/share/zoneinfo/Asia/Shanghai
  92.       - name: data
  93.         hostPath:
  94.           type: DirectoryOrCreate 
  95.           path: /data/elk/elk-redis
  96.       nodeName: gem-yxyw-t-c02
  97. ---

为了提升redis的性能需要关闭持久化

、redis默认是开启持久化的

2、默认持久化方式为RDB

1、注释掉原来的持久化规则

  1. # save 3600 1 300 100 60 10000

2、把 save 节点设置为空

save ""

3、删除 dump.rdb 转储文件

rm -f dump.rdb

1、设置 appendonly 的值为 no 即可

 

6. 部署filebeat,部署k8s上没有成功，改成源码部署到主机成功了
 

  1. wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.8.0-linux-x86_64.tar.gz
  2.  
  3. tar -zxvf filebeat-7.8.0-linux-x86_64.tar.gz
  4.  
  5. vi /data/elk/filebeat/filebeat-7.8.0-linux-x86_64/filebeat.yml 
  6.  
  7. filebeat.inputs:
  8. - type: log
  9.   enabled: true
  10.   paths:
  11.     - /data/test-logs/osale-uc-test/*.log
  12.   fields:
  13.   tags: ["osale-uc-test"]
  14. - type: log
  15.   enabled: true
  16.   paths:
  17.     - /data/test-logs/osale-jindi-client-test/*.log
  18.   fields:
  19.   tags: ["osale-jindi-client-test"]
  20. - type: log
  21.   enabled: true
  22.   paths:
  23.     - /data/test-logs/osale-admin-weixin-test/*/osale-admin-weixin/*.log
  24.   fields:
  25.   tags: ["osale-admin-weixin"]
  26. - type: log
  27.   enabled: true
  28.   paths:
  29.     - /data/tengine/logs/*.log
  30.   fields:
  31.   tags: ["nginx.log"]
  32.  
  33. filebeat.config.modules:
  34.   path: ${path.config}/modules.d/*.yml
  35.   reload.enabled: false
  36. setup.template.settings:
  37.   index.number_of_shards: 1
  38. setup.kibana:
  39. output.redis:
  40.   enabled: true
  41.   hosts: ["10.36.21.220:30079"]
  42.   password: "123456"
  43.   db: 0
  44.   key: localhost
  45.   worker: 4
  46.   timeout: 5
  47.   max_retries: 3
  48.   datatype: list
  49. processors:
  50.   - add_host_metadata: ~
  51.   - add_cloud_metadata: ~
  52.   - add_docker_metadata: ~
  53.   - add_kubernetes_metadata: ~
 

  1. ---
  2. apiVersion: v1
  3. kind: ConfigMap
  4. metadata:
  5.   name: filebeat-config-to-logstash
  6.   namespace: halashow
  7. data:
  8.   filebeat.yml: |-
  9.     filebeat.inputs:
  10.     - type: log
  11.       paths:
  12.         - /logm/*.log
  13.     output.logstash:
  14.       hosts: ['logstash:5044']
  15.  
  16. ---
  17. apiVersion: apps/v1
  18. kind: Deployment
  19. metadata:
  20.   name: filebeat
  21.   namespace: halashow
  22.   labels: 
  23.     name: filebeat
  24. spec:
  25.   replicas: 1
  26.   selector:
  27.     matchLabels: 
  28.       name: filebeat
  29.   template:
  30.     metadata:
  31.       labels: 
  32.         app: filebeat
  33.         name: filebeat
  34.     spec:
  35.       containers:
  36.       - name: filebeat
  37.         image: docker.elastic.co/beats/filebeat:7.12.0
  38.         args: [
  39.           "-c", "/etc/filebeat.yml",
  40.           "-e",
  41.         ]
  42.  
  43.         volumeMounts:
  44.         - mountPath: /logm
  45.           name: logm
  46.         - name: config
  47.           mountPath: /etc/filebeat.yml
  48.           readOnly: true
  49.           subPath: filebeat.yml
  50.  
  51.       volumes:
  52.       - name: logm 
  53.         emptyDir: {}
  54.       - name: config
  55.         configMap:
  56.           defaultMode: 0640
  57.           name: filebeat-config-to-logstash
 

cd /data/elk/filebeat-7.8.0-linux-x86_64 
  
 sudo ./filebeat -e -c filebeat.yml -d "publish"        #前台启动filebeat
  
 nohup ./filebeat -e -c filebeat.yml >/dev/null 2>&1&   #后台启动
  
 

6 部署kibana　　
 

 

6.1 准备资源配置清单
 

  1. apiVersion: apps/v1
  2. kind: Deployment
  3. metadata:
  4.   name: kibana
  5.   namespace: halashow
  6.   labels:
  7.     name: kibana
  8. spec:
  9.   serviceName: halashow
  10.   replicas: 1
  11.   selector:
  12.     matchLabels:
  13.       name: kibana
  14.   template:
  15.     metadata:
  16.       labels:
  17.         app: kibana
  18.         name: kibana
  19.     spec:
  20.       restartPolicy: Always
  21.       containers:
  22.         - name: kibana
  23.           image: kibana:7.12.0
  24.           imagePullPolicy: Always
  25.           ports:
  26.             - containerPort: 5601
  27.           resources:
  28.             requests:
  29.               memory: 1024Mi
  30.               cpu: 50m
  31.             limits:
  32.               memory: 1024Mi
  33.               cpu: 1000m
  34.           volumeMounts:
  35.             - name: kibana-config
  36.               mountPath: /usr/share/kibana/config/kibana.yml
  37.               subPath: kibana.yml
  38.       volumes:
  39.         - name: kibana-config
  40.           configMap:
  41.             name: kibana-cm
  42.             items:
  43.             - key: "kibana.yml"
  44.               path: "kibana.yml"
  45. ---
  46. apiVersion: v1
  47. kind: Service
  48. metadata:
  49.   labels:
  50.     app: kibana
  51.   name: kibana
  52.   namespace: halashow
  53. spec:
  54.   type: NodePort
  55.   ports:
  56.     - name: kibana
  57.       port: 5601
  58.       nodePort: 30102
  59.       protocol: TCP
  60.       targetPort: 5601
  61.   selector:
  62.     app: kibana
  63.  
  64. server.name: kibana
  65. server.host: "0"
  66. elasticsearch.hosts: [ "http://elasticsearch:9200" ]
  67. monitoring.ui.container.elasticsearch.enabled: true
  68. i18n.locale: "zh-CN"  #kibana汉化
 

 

 

 

 

 

location /  #必须是/否则代码不上
 

passpoxry http:ip:port
 

 

 1.Kibana设置elasticsearch索引过期时间，到期自动删除
 

首先创建一个索引，索引必须名字后面*这样所有日期都能检索出。然后在创建一个十天的日志生命周期管理，在创建一个索引模板，索引模板可以检索出所有需要检索的日志，这个索引模板可以直接复制日志生命周期管理代码，也可之后日志生命周期里面加入这个索引模板。
 

 

 
 

2.创建一个索引生命周期策略 
 

Index Management    索引管理
 Index Lifecycle Policies   索引生命周期策略
 

Delete phase  删除阶段
 

 
 

 

 
 

 

 
 

 

3.创建一个索引模板用来管理所有索引
 

Index Templates    索引模板
 

 

 
 

 
 

 
 

 

  1. {
  2.   "index": {
  3.     "lifecycle": {
  4.       "name": "gdnb-tes*"
  5.     }
  6.   }
  7. }
 

 可将索引周期管理的代码复制过去，也可直接到索引周期管理里面选择gdnb-test-10day这个索引模板
 

 

 
 

 

3.将需要保存十天的日志索引模板加入刚创建的周期生命管理 
 

 
 

 

                

        
声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/我家小花儿/article/detail/944657
推荐阅读
相关标签
Copyright ©  2003-2013 www.wpsshop.cn  版权所有，并保留所有权利。

  
闽ICP备14008679号