1. Download the Chart Package 1 git clone https://github.com/loggie-io/installation 2. Install loggie 1 cd installation/helm-chart 1 helm install loggie ./ -nloggie --create-namespace 3. Global Configuration Changes Remove the timestamp in front of stdout 1 kubectl -n loggie edit cm loggie-config-loggie Set parseStdout to true to remove the timestamp in front of stdout.

1. Symptoms Pod information can be viewed 1 2 3 4 kubectl -n my-testns get pod my-testpod NAME READY STATUS RESTARTS AGE my-testpod 1/1 Running 0 2d13h Pod logs cannot be viewed 1 2 3 kubectl -n my-testns logs my-testpod -f Error from server (NotFound): the server could not find the requested resource ( pods/log my-testpod) On the host where the Pod runs, the container logs can be viewed with docker logs.

If you use Logstash to centrally receive the log input from Filebeat, it easily creates a single point of bottleneck; if you use Kafka to receive the log input from Filebeat, the timeliness of the logs is not guaranteed. Here we output the logs collected by Filebeat directly to Elasticsearch.

1. How Logstash Works Logstash is a component for data transport and processing. Through combinations of plugins, Logstash can handle a wide variety of log collection scenarios: logstash->elasticsearch filebeat->logstash->elasticsearch filebeat->kafka->logstash->elasticsearch filebeat->redis->logstash->elasticsearch 2. Basic Logstash Configuration Here is the format of a Logstash configuration: 1 2 3 4 5 6 7

This article gives a brief introduction to the ELK stack and provides a Docker compose orchestration configuration. After reading it, you can get ELK running locally with Docker. A later article will cover deploying ELK on servers and adding the related configuration. 1. Introduction to the ELK Stack ELK is not actually a single piece of software but a whole solution — an acronym formed from the initials of three software products: Elasticsearch, Logstash, and Kibana.