From 8e50f5b2fbbbfc39bc1c528ed61b19f43d4d9109 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lauri=20V=C3=B5sandi?= Date: Mon, 29 Aug 2022 21:23:47 +0300 Subject: [PATCH] logging: Replace Fluent Bit with Filebeat --- logging/README.md | 7 +- logging/application.yml | 221 +++------------------------------------- logging/filebeat.yml | 196 +++++++++++++++++++++++++++++++++++ 3 files changed, 216 insertions(+), 208 deletions(-) create mode 100644 logging/filebeat.yml diff --git a/logging/README.md b/logging/README.md index cd09edd..2c3efb0 100644 --- a/logging/README.md +++ b/logging/README.md @@ -14,8 +14,8 @@ To deploy: ``` kubectl create namespace logging -kubectl apply -n logging -f mongodb-support.yml -f application.yml -f networkpolicy-base.yml -kubectl rollout restart -n logging daemonset/fluent-bit +kubectl apply -n logging -f mongodb-support.yml -f application.yml -f filebeat.yml -f networkpolicy-base.yml +kubectl rollout restart -n logging daemonset.apps/filebeat ``` To set secrets: @@ -44,7 +44,8 @@ After Graylog deployment following steps were manually performed via web interfa * Add Syslog TCP input for external Linux hosts * Add Syslog UDP input for Mikrotik networking gear -* Add GELF TCP input for Kubernetes workers +* Add Beats input for Kubernetes workers, + enable `Do not add Beats type as prefix` * Trusted header authentication was enabled and set to `Remote-User` https://graylog.k-space.ee/system/authentication/authenticator/edit Note that user accounts are not provisioned automatically. diff --git a/logging/application.yml b/logging/application.yml index 0bd9b9c..7adca52 100644 --- a/logging/application.yml +++ b/logging/application.yml @@ -1,207 +1,4 @@ --- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: fluent-bit ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: fluent-bit-read -rules: -- apiGroups: [""] - resources: - - namespaces - - pods - verbs: ["get", "list", "watch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: fluent-bit-read -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: fluent-bit-read -subjects: -- kind: ServiceAccount - name: fluent-bit - namespace: logging ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: fluent-bit-config - namespace: logging - labels: - app: fluent-bit - annotations: - reloader.stakater.com/match: "true" -data: - fluent-bit.conf: | - [SERVICE] - Flush 1 - Log_Level warn - Daemon off - Parsers_File parsers.conf - HTTP_Server On - HTTP_Listen 0.0.0.0 - HTTP_Port 2020 - @INCLUDE input-kubernetes.conf - @INCLUDE filter-kubernetes.conf - @INCLUDE output-graylog.conf - input-kubernetes.conf: | - # Following assembles the log fragments of the Kubernetes runtime - # https://github.com/fluent/fluent-bit/blob/d3c71f2ed4ff3625b85715aaefe6bc76b2ac3c2e/src/multiline/flb_ml_parser_docker.c#L57 - [INPUT] - name tail - tag kube.* - path /var/log/containers/*.log - multiline.parser cri - db /var/log/flb_kube.db - mem_buf_limit 5MB - skip_long_lines on - refresh_interval 10 - filter-kubernetes.conf: | - # Following reassembles stack traces - [FILTER] - name multiline - match * - multiline.key_content log - multiline.parser go,python,java - # Following annotates the Kubernetes logs using Kubernetes API-s - [FILTER] - Name kubernetes - Match kube.* - Kube_URL https://kubernetes.default.svc:443 - Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt - Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token - Kube_Tag_Prefix kube.var.log.containers. - Merge_Log On - K8S-Logging.Parser On - K8S-Logging.Exclude Off - # Following unnests the kubernetes map - [FILTER] - Name nest - Match kube.* - Operation lift - Nested_under kubernetes - Add_prefix kubernetes_ - output-graylog.conf: | - [OUTPUT] - Name gelf - Match * - Host graylog-gelf-tcp - Port 12201 - Mode tcp - Gelf_Host_Key kubernetes_host - Gelf_Short_Message_Key log - Retry_Limit no_limits - parsers.conf: | - # http://rubular.com/r/tjUt3Awgg4 - [PARSER] - Name cri - Format regex - Regex ^(?