Skip to content
This repository was archived by the owner on Apr 24, 2023. It is now read-only.

Commit 5db626b

Browse files
committed
fluent bit on OpenShift to OpenSearch
Signed-off-by: xieshujian <[email protected]>
1 parent bbb127f commit 5db626b

File tree

3 files changed

+213
-0
lines changed

3 files changed

+213
-0
lines changed

README.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,20 @@ If you are using Minikube for testing purposes, use the following alternative Da
8787
$ kubectl create -f https://raw.githubusercontent.com/fluent/fluent-bit-kubernetes-logging/master/output/elasticsearch/fluent-bit-ds-minikube.yaml
8888
```
8989

90+
#### Fluent Bit to OpenSearch on OpenShift4
91+
If you are use OpenSearch and OpenShift, user the following ConfigMap and DaemonSet.
92+
- For the OpenSearch, add tsl setting, as it use https default
93+
- For the OpenShift, add security context on daemonset, and increase buffer size to 1Mb on kuberneters filter
94+
```
95+
$ oc new-project logging
96+
$ oc apply -f https://raw.githubusercontent.com/fluent/fluent-bit-kubernetes-logging/master/fluent-bit-service-account.yaml
97+
$ oc apply -f https://raw.githubusercontent.com/fluent/fluent-bit-kubernetes-logging/master/fluent-bit-role-1.22.yaml
98+
$ oc apply -f https://raw.githubusercontent.com/fluent/fluent-bit-kubernetes-logging/master/fluent-bit-role-binding-1.22.yaml
99+
$ oc apply -f https://raw.githubusercontent.com/fluent/fluent-bit-kubernetes-logging/master/fluent-bit-openshift-security-context-constraints.yaml
100+
$ oc apply -f https://raw.githubusercontent.com/fluent/fluent-bit-kubernetes-logging/master/output/opensearch/fluent-bit-opensearch-openshift-configmap.yaml
101+
$ oc apply -f https://raw.githubusercontent.com/fluent/fluent-bit-kubernetes-logging/master/output/opensearch/fluent-bit-ds-openshift.yaml
102+
```
103+
90104
## Details
91105

92106
The default configuration of Fluent Bit makes sure of the following:
Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
apiVersion: apps/v1
2+
kind: DaemonSet
3+
metadata:
4+
name: fluent-bit
5+
namespace: logging
6+
labels:
7+
k8s-app: fluent-bit-logging
8+
version: v1
9+
kubernetes.io/cluster-service: "true"
10+
spec:
11+
selector:
12+
matchLabels:
13+
k8s-app: fluent-bit-logging
14+
template:
15+
metadata:
16+
labels:
17+
k8s-app: fluent-bit-logging
18+
version: v1
19+
kubernetes.io/cluster-service: "true"
20+
annotations:
21+
prometheus.io/scrape: "true"
22+
prometheus.io/port: "2020"
23+
prometheus.io/path: /api/v1/metrics/prometheus
24+
spec:
25+
containers:
26+
- name: fluent-bit
27+
image: fluent/fluent-bit:1.9.2
28+
imagePullPolicy: IfNotPresent
29+
securityContext:
30+
capabilities:
31+
drop:
32+
- CHOWN
33+
- DAC_OVERRIDE
34+
- FOWNER
35+
- FSETID
36+
- KILL
37+
- NET_BIND_SERVICE
38+
- SETGID
39+
- SETPCAP
40+
- SETUID
41+
seLinuxOptions:
42+
type: spc_t
43+
readOnlyRootFilesystem: true
44+
allowPrivilegeEscalation: false
45+
ports:
46+
- containerPort: 2020
47+
env:
48+
- name: FLUENT_ELASTICSEARCH_HOST
49+
value: "elasticsearch"
50+
- name: FLUENT_ELASTICSEARCH_PORT
51+
value: "9200"
52+
volumeMounts:
53+
- name: varlog
54+
mountPath: /var/log
55+
- name: varlibdockercontainers
56+
mountPath: /var/lib/docker/containers
57+
readOnly: true
58+
- name: fluent-bit-config
59+
mountPath: /fluent-bit/etc/
60+
terminationGracePeriodSeconds: 10
61+
volumes:
62+
- name: varlog
63+
hostPath:
64+
path: /var/log
65+
- name: varlibdockercontainers
66+
hostPath:
67+
path: /var/lib/docker/containers
68+
- name: fluent-bit-config
69+
configMap:
70+
name: fluent-bit-config
71+
serviceAccountName: fluent-bit
72+
tolerations:
73+
- key: node-role.kubernetes.io/master
74+
operator: Exists
75+
effect: NoSchedule
76+
- operator: "Exists"
77+
effect: "NoExecute"
78+
- operator: "Exists"
79+
effect: "NoSchedule"
Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: fluent-bit-config
5+
namespace: logging
6+
labels:
7+
k8s-app: fluent-bit
8+
data:
9+
# Configuration files: server, input, filters and output
10+
# ======================================================
11+
fluent-bit.conf: |
12+
[SERVICE]
13+
Flush 1
14+
Log_Level info
15+
Daemon off
16+
Parsers_File parsers.conf
17+
HTTP_Server On
18+
HTTP_Listen 0.0.0.0
19+
HTTP_Port 2020
20+
21+
@INCLUDE input-kubernetes.conf
22+
@INCLUDE filter-kubernetes.conf
23+
@INCLUDE output-elasticsearch.conf
24+
25+
input-kubernetes.conf: |
26+
[INPUT]
27+
Name tail
28+
Tag kube.*
29+
Path /var/log/containers/*.log
30+
Parser cri
31+
DB /var/log/flb_kube.db
32+
Mem_Buf_Limit 5MB
33+
Skip_Long_Lines On
34+
Refresh_Interval 10
35+
36+
filter-kubernetes.conf: |
37+
[FILTER]
38+
Name kubernetes
39+
Match kube.*
40+
Kube_URL https://kubernetes.default.svc:443
41+
Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
42+
Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token
43+
Kube_Tag_Prefix kube.var.log.containers.
44+
Merge_Log On
45+
Merge_Log_Key log_processed
46+
K8S-Logging.Parser On
47+
K8S-Logging.Exclude Off
48+
Buffer_Size 1Mb
49+
50+
output-elasticsearch.conf: |
51+
[OUTPUT]
52+
Name opensearch
53+
Match kube.*
54+
Host {OPENSEARCH_HOST}
55+
Port {OPENSEARCH_PORT}
56+
HTTP_User {OPENSEARCH_USER}
57+
HTTP_Passwd {OPENSEARCH_PASSWORD}
58+
tls On
59+
tls.verify Off
60+
Replace_Dots On
61+
Logstash_Format On
62+
Logstash_Prefix {MY_PREFIX}
63+
Logstash_Prefix_Key {MY_PREFIX}
64+
Index {MY_INDEX}
65+
Type {MY_TYPE}
66+
67+
parsers.conf: |
68+
[PARSER]
69+
Name apache
70+
Format regex
71+
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
72+
Time_Key time
73+
Time_Format %d/%b/%Y:%H:%M:%S %z
74+
75+
[PARSER]
76+
Name apache2
77+
Format regex
78+
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
79+
Time_Key time
80+
Time_Format %d/%b/%Y:%H:%M:%S %z
81+
82+
[PARSER]
83+
Name apache_error
84+
Format regex
85+
Regex ^\[[^ ]* (?<time>[^\]]*)\] \[(?<level>[^\]]*)\](?: \[pid (?<pid>[^\]]*)\])?( \[client (?<client>[^\]]*)\])? (?<message>.*)$
86+
87+
[PARSER]
88+
Name nginx
89+
Format regex
90+
Regex ^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
91+
Time_Key time
92+
Time_Format %d/%b/%Y:%H:%M:%S %z
93+
94+
[PARSER]
95+
Name json
96+
Format json
97+
Time_Key time
98+
Time_Format %d/%b/%Y:%H:%M:%S %z
99+
100+
[PARSER]
101+
Name docker
102+
Format json
103+
Time_Key time
104+
Time_Format %Y-%m-%dT%H:%M:%S.%L
105+
Time_Keep On
106+
107+
[PARSER]
108+
# http://rubular.com/r/tjUt3Awgg4
109+
Name cri
110+
Format regex
111+
Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
112+
Time_Key time
113+
Time_Format %Y-%m-%dT%H:%M:%S.%L%z
114+
115+
[PARSER]
116+
Name syslog
117+
Format regex
118+
Regex ^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$
119+
Time_Key time
120+
Time_Format %b %d %H:%M:%S

0 commit comments

Comments
 (0)