1. Download the Chart Package
1
| git clone https://github.com/loggie-io/installation
|
2. Install loggie
1
| cd installation/helm-chart
|
1
| helm install loggie ./ -nloggie --create-namespace
|
3. Global Configuration Changes
- Remove the timestamp in front of stdout
1
| kubectl -n loggie edit cm loggie-config-loggie
|
Set parseStdout to true to remove the timestamp in front of stdout.
1
2
3
4
5
6
| config:
loggie:
discovery:
enabled: true
kubernetes:
parseStdout: true
|
- Change podlogs to a varlog mount
1
| kubectl -n loggie edit ds loggie
|
1
2
3
4
5
6
7
8
9
| volumeMounts:
- mountPath: /var/log
name: varlog
readOnly: true
volumes:
- hostPath:
path: /var/log
type: DirectoryOrCreate
name: varlog
|
- Add metadata to node-level collection
1
| kubectl -n loggie edit cm loggie-config-loggie
|
1
2
3
4
| typeNodeFields:
nodename: "${_k8s.node.name}"
clusterlogconfig: "${_k8s.clusterlogconfig}"
os: "${_k8s.node.nodeInfo.osImage}"
|
- Add metadata to pod-level collection
1
| kubectl -n loggie edit cm loggie-config-loggie
|
1
2
3
| typePodFields:
workloadkind: "${_k8s.workload.kind}"
workloadname: "${_k8s.workload.name}"
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
| cat << 'EOF' | sudo tee /etc/systemd/system/kubelet-log.service
[Unit]
Description=Kubelet log collector
After=network.target
[Service]
Type=simple
ExecStart=/usr/bin/journalctl -u kubelet.service -f
StandardOutput=append:/var/log/kubelet.log
StandardError=inherit
LogRateLimitIntervalSec=0
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.target
EOF
|
1
2
3
| systemctl daemon-reload
systemctl enable kubelet-log.service
systemctl restart kubelet-log.service
|
5. Quick Configuration for Applications
- Configure environment variables
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
| export NAMESPACE=""
export ES_INDEX=""
export ES_PORT=""
export ES_HOSTS=""
export ES_USERNAME=""
export ES_PASSWORD=""
export POD_LABEL_KEY=""
export POD_LABEL_VALUE=""
ES_HOSTS_YAML=""
IFS=',' read -ra _es_host_arr <<< "${ES_HOSTS}"
for _h in "${_es_host_arr[@]}"; do
_h="${_h#"${_h%%[![:space:]]*}"}"
_h="${_h%"${_h##*[![:space:]]}"}"
[[ -z "${_h}" ]] && continue
ES_HOSTS_YAML+=" - \"http://${_h}:${ES_PORT}\""$'\n'
done
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
| cat << EOF | kubectl apply -f -
apiVersion: loggie.io/v1beta1
kind: Sink
metadata:
name: default
namespace: ${NAMESPACE}
spec:
sink: |
type: elasticsearch
index: "${ES_INDEX}"
hosts:
${ES_HOSTS_YAML}
username: "${ES_USERNAME}"
password: "${ES_PASSWORD}"
EOF
|
- Configure the Interceptor
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
| cat << EOF | kubectl apply -f -
apiVersion: loggie.io/v1beta1
kind: Interceptor
metadata:
name: default
namespace: ${NAMESPACE}
spec:
interceptors: |
- type: jsonDecode
field: message
- type: schema
addMeta:
timestamp:
key: "@timestamp"
remap:
body:
key: message
EOF
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| cat << EOF | kubectl apply -f -
apiVersion: loggie.io/v1beta1
kind: Interceptor
metadata:
name: default
namespace: ${NAMESPACE}
spec:
interceptors: |
- type: schema
addMeta:
timestamp:
key: "@timestamp"
remap:
body:
key: message
EOF
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| cat << EOF | kubectl apply -f -
apiVersion: loggie.io/v1beta1
kind: LogConfig
metadata:
name: default
namespace: ${NAMESPACE}
spec:
selector:
type: pod
labelSelector:
"${POD_LABEL_KEY}": "${POD_LABEL_VALUE}"
pipeline:
sources: |
- type: file
name: common
paths:
- stdout
sinkRef: default
interceptorRef: default
EOF
|
6. Prevent It from Running on Master Nodes
We found that loggie consumes a fairly large amount of IO, so we exclude master nodes first to avoid affecting cluster stability.
1
2
3
4
5
6
7
8
9
10
| spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: DoesNotExist
- key: node-role.kubernetes.io/master
operator: DoesNotExist
|
7. Adjust loggie’s Log Level
1
2
3
4
5
6
| spec:
template:
spec:
containers:
- args:
- -log.level=panic
|
loggie’s default log level is info, and it sometimes prints a large amount of logs. The log levels, from low to high, are trace, debug, info, warn, error, fatal, panic. The lower the log level, the more verbose the output; the higher the log level, the less output there is.
8. References
