Quellcode durchsuchen

可以通过脚本部署,zk/es/kibana

yangxg vor 4 Jahren
Ursprung
Commit
9be9384dcb
1 geänderte Dateien mit 62 neuen und 0 gelöschten Zeilen
  1. 62 0
      deploy-tmp-logstash.yaml

+ 62 - 0
deploy-tmp-logstash.yaml

@@ -0,0 +1,62 @@
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: logstash-config
+  namespace: qa
+data:
+  logstash-config-named-k8s: |
+    input {
+      beats {
+        port => 5044
+      }
+    }
+    
+    filter {
+      grok {
+        match => ["message", "(?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) queries: client %{IPV4:c_ip}#%{NUMBER:c_port}: query: %{NOTSPACE:queryrec} %{NOTSPACE:dnsclass} %{NOTSPACE:dnstype} \+ \(%{IPV4:dnsbind}\)"]
+      }
+    }
+
+    output {
+      #stdout { codec => rubydebug }
+      elasticsearch {
+        hosts => ["elasticsearch:9200"]
+        index => "logstash-filebeat-%{+YYYY.MM.dd}"
+      }
+    }
+---
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: logstash-k8s-named
+  namespace: qa
+  labels:
+    app: logstash-k8s-named
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: logstash-k8s-named
+  template:
+    metadata:
+      labels:
+        app: logstash-k8s-named
+    spec:
+      containers:
+      - name: logstash-k8s-named
+        image: dockerhub-pr.yeshj.com/ops/logstash:7.6.2
+        command: ["/bin/sh","-c"]
+        args: ["/usr/share/logstash/bin/logstash -f /usr/share/logstash/config/indexer-kafka-named-k8s.conf"]
+        volumeMounts:
+        - name: vm-config
+          mountPath: /usr/share/logstash/config
+      imagePullSecrets:
+      - name: regcred-elastic
+      volumes:
+      - name: vm-config
+        configMap:
+          name: logstash-config
+          items:
+          - key: logstash-config-named-k8s
+            path: indexer-kafka-named-k8s.conf