一，运行一个elasticsearch。

在虚拟机上，不使用root帐号，使用elasticsearch帐号。因为filebeat要远程连接elasticsearch，所以要允许远程访问ES。
elasticsearch.yml

network.host: 0.0.0.0
#
# Set a custom port for HTTP:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["node-1"]

启动elasticsearch

bin/elasticsearch
[2020-11-02T20:27:46,243][INFO ][o.e.n.Node               ] [localhost.localdomain] version[7.9.3], pid[1585], build[default/tar/c4138e51121ef06a6404866cddc601906fe5c868/2020-10-16T10:36:16.141335Z], OS[Linux/3.10.0-1127.el7.x86_64/amd64], JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/15/15+36-1562]
[2020-11-02T20:27:46,250][INFO ][o.e.n.Node               ] [localhost.localdomain] JVM home [/usr/local/elasticsearch-7.9.3/jdk]
...
[2020-11-02T20:27:59,016][INFO ][o.e.x.s.s.SecurityStatusChangeListener] [localhost.localdomain] Active license is now [BASIC]; Security is disabled
[2020-11-02T20:27:59,032][INFO ][o.e.g.GatewayService     ] [localhost.localdomain] recovered [11] indices into cluster_state
[2020-11-02T20:28:00,593][INFO ][o.e.c.r.a.AllocationService] [localhost.localdomain] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[.kibana_task_manager_1][0], [.kibana_2][0]]]).

二，启动kibana

测试时，使用root帐号启动

bin/kibana --allow-root
 log   [12:30:46.413] [warning][plugins-discovery] Expect plugin "id" in camelCase, but found: beats_management
  log   [12:30:46.434] [warning][plugins-discovery] Expect plugin "id" in camelCase, but found: triggers_actions_ui
  log   [12:31:04.787] [info][plugins-service] Plugin "visTypeXy" is disabled.
  log   [12:31:04.788] [info][plugins-service] Plugin "auditTrail" is disabled.
...
  log   [12:31:12.728] [info][server][Kibana][http] http server running at http://0.0.0.0:5601

三，一个简单的springboot日志示例及docker镜像

2020-11-02 00_08_08CloudNative-2.pptx - PowerPoint.png

Dockerfile

FROM openjdk:8-alpine

COPY helloworld-0.0.1-SNAPSHOT.jar /app/

WORKDIR /app

CMD ["java", "-jar", "helloworld-0.0.1-SNAPSHOT.jar"]

四，一个简单的filebeat配置文件及docker镜像

filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /app/logger/*.log
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

output.elasticsearch:
  hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'
  username: '${ELASTICSEARCH_USERNAME:}'
  password: '${ELASTICSEARCH_PASSWORD:}'

Dockerfile

FROM elastic/filebeat:7.9.3

COPY filebeat.yml /usr/share/filebeat/filebeat.yml

五，最近应用一个yaml到集群中，定义好es的地址，定义好log目录的挂载

springboot-log.yaml


apiVersion: apps/v1
kind: Deployment
metadata:
  name: springboot-deployment
spec:
  selector:
    matchLabels:
      app: helloworld
  replicas: 1
  template:
    metadata:
      labels:
        app: helloworld
    spec:
      containers:
      - name: springboot
        image: helloworld:v0.1
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 9090
        volumeMounts:
        - name: log-storage
          mountPath: /app/logger/
      - name: filebeat
        image: elastic/filebeat:7.9.3-demo
        imagePullPolicy: IfNotPresent
        env:
        - name: ELASTICSEARCH_HOSTS
          value: 192.168.1.211:9200
        volumeMounts:
        - name: log-storage
          mountPath: /app/logger/
      volumes:
      - name: log-storage
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: springboot-service
spec:
  selector:
    app: helloworld
  ports:
  - protocol: TCP
    port: 9090
    targetPort: 9090
  type: NodePort