1、重写dockerfile

FROM elastic/filebeat:7.10.2
# 自定义指定 filebeat.yaml
CMD ["-e", "-c", "elk-log.yml"]

2、k8s部署filebeat并写入kafka

2.1、filebeat-config yaml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: log-filebeat-config
  namespace: log-namespace
data:
  elk-log.yml: |
    filebeat.inputs:
    - type: log
      include_lines:  ['^[0-9]{4}-[0-9]{2}']
      multiline.pattern: '^[0-9]{4}'
      multiline.negate: true
      multiline.match: after
      encoding: UTF-8
      fields:
        wisentIp: 0.0.0.0
      paths:
        - /xxxx/xxx.log
    output.kafka:
      # Boolean flag to enable or disable the output module.
      enable: true
      topic: ${KAFKA_FILEBEAT_TOPIC:elkpub}
      # The Logstash hosts
      hosts: ${KAFKA_HOSTS:["192.168.0.82:9092"]}

2.1、Deployment yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    description: logs-filebeat
  name: logs-filebeat
  namespace: log-namespace
spec:
  replicas: 1
  selector:
    matchLabels:
      app: logs-filebeat
  template:
    metadata:
      labels:
        app: logs-filebeat
    spec:
      containers:
        - env:
            - name: TZ
              value: Asia/Shanghai
            - name: KAFKA_HOSTS
              value: "[192.168.0.82:9092]"
          image: filebeat:7.10.2
          imagePullPolicy: Always
          name: logs-filebeat
          resources:
            limits:
              cpu: 500m
              memory: 1024Mi
            requests:
              cpu: 250m
              memory: 200Mi
          volumeMounts:
            - name: cloud-log-namespace-pvc
              mountPath: /appdata/services
              subPath: logs/
              readOnly: true
            - name: train-log-filebeat-config
              mountPath: /usr/share/filebeat/elk-log.yml
              subPath: elk-log.yml

      terminationGracePeriodSeconds: 10
      volumes:
        - name: cloud-log-namespace-dev-pvc
          persistentVolumeClaim:
            claimName: log-namespace-pvc
        - name: train-log-filebeat-config
          configMap:
            name: log-filebeat-config