kubernetes快速部署EFK日志系统

主页：
https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/fluentd-elasticsearch
下载官方yaml：

mkdir efk && cd efk
wget  https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/fluentd-elasticsearch/es-statefulset.yaml
wget  https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/fluentd-elasticsearch/es-service.yaml
wget  https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/fluentd-elasticsearch/fluentd-es-configmap.yaml
wget  https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/fluentd-elasticsearch/fluentd-es-ds.yaml
wget  https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/fluentd-elasticsearch/kibana-service.yaml
wget  https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/fluentd-elasticsearch/kibana-deployment.yaml

修改镜像源和版本，：

#es-statefulset.yaml    
elasticsearch-osselasticsearch:6.5.4#fluentd-es-ds.yaml    
willdockerhub/fluentd-elasticsearch:v2.3.2
#kibana-deployment.yaml    
docker.elastic.co/kibana/kibana-oss:6.5.4

修改kibana部署文件为(注意configmap的域名)：

apiVersion: v1
kind: ConfigMap
metadata:
  name: kibana
  namespace: kube-system
  labels:
    app: kibana
data:
  # kibana.yml is mounted into the Kibana container
  # see https://github.com/elastic/kibana/blob/master/config/kibana.yml
  # Kubernetes Ingress is used to route kib.the-project.d4ldev.txn2.com
  kibana.yml: |-
    server.name: kibana.multi.io
    server.host: "0"
    elasticsearch.url: http://elasticsearch-logging:9200
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kibana-logging
  namespace: kube-system
  labels:
    k8s-app: kibana-logging
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: kibana-logging
  template:
    metadata:
      labels:
        k8s-app: kibana-logging
      annotations:
        seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
    spec:
      volumes:
      - name: kibana-config-volume
        configMap:
          name: kibana
      containers:
      - name: kibana-logging
        image: docker.elastic.co/kibana/kibana-oss:6.5.4
        volumeMounts:
        - name: kibana-config-volume
          mountPath: /usr/share/kibana/config
        env:
        - name: CLUSTER_NAME
          value: elasticsearch
        ports:
        - containerPort: 5601
          name: ui
          protocol: TCP

在各节点打标签：

kubectl label node node01 beta.kubernetes.io/fluentd-ds-ready=true
kubectl label node node02 beta.kubernetes.io/fluentd-ds-ready=true
kubectl label node node03 beta.kubernetes.io/fluentd-ds-ready=true

部署：
#必须部署在kube-system空间，因为fluent中存在 pods with system-node-critical priorityClass
kubectl apply -f .
创建一个ingress：

kind: Ingress
apiVersion: extensions/v1beta1
metadata: 
    name: kibana-dashboard
    namespace: kube-system
    annotations:
        kubernetes.io/ingress.class: traefik
spec:
    rules:
    -   host: kibana.yourdm.com
        http:
            paths:
            -   backend:
                    serviceName: kibana-logging
                    servicePort: 5601
                path: /

访问http://kibana.yourdm.com/app/kibana
点击导航栏 “Management” -> “index pattern”， Index pattern默认 logstash-* 即可：
“Time-field name” 默认 @timestamp，最后点击 “Create” 即可完成索引创建。

等待一会，查看边栏中的”Discover”，稍等即可发现数据：