架构
ELK
ElasticSearch是个开源的分布式搜索引擎，存储日志及提供查询接口
Logstash是一个完全开源的工具，他可以对日志进行收集发送给ES
Kibana是一个开源和免费的web界面的工具，可以让用户浏览ES里的日志
Logstash性能低，消耗资源，且存在不支持消息队列缓存及存在数据丢失
所以Logstash一般可以用fluentd或者filebeat替代，这就有了EFK
部署
ES
创建一个elastic的源，但是如果从这个源pull会很慢[root@vms61 helm3]# helm repo add elastic https://helm.elastic.co
"elastic" has been added to your repositories
[root@vms61 helm3]# helm repolist
Error: unknown command "repolist" for "helm"
Run 'helm --help' for usage.
[root@vms61 helm3]# helm repo list
NAME URL
ali https://apphub.aliyuncs.com
azure http://mirror.azure.cn/kubernetes/charts/
elastic https://helm.elastic.co
[root@vms61 helm3]# mkdir efk
[root@vms61 helm3]# cd efk
[root@vms61 efk]# helm pull elastic/elasticsearch
将事先下载好的包上传至服务器
将es镜像分别拷贝至worker节点，并在三个节点load导入镜像
此实验先修改replicas为2，最小MasterNodes为1，暂时不用持久性存储
此实验先修改replicas为2，最小MasterNodes为1，暂时不用持久性存储
安装es成功[root@vms61 elasticsearch]# helm install elastic .
NAME: elastic
LAST DEPLOYED: Sat Oct 17 17:12:04 2020
NAMESPACE: chap11-helm
STATUS: deployed
REVISION: 1
NOTES:
1. Watch all cluster members come up.
$ kubectl get pods --namespace=chap11-helm -l app=elasticsearch-master -w
2. Test cluster health using Helm test.
$ helm test elastic --cleanup
[root@vms61 elasticsearch]# kubectl get pods
NAME READY STATUS RESTARTS AGE
elasticsearch-master-0 1/1 Running 0 2m26s
elasticsearch-master-1 1/1 Running 0 2m26s
Filebeat
同样的，先下载好，然后同步至其他节点，三台都load导入[root@vms61 efk]# tar zxvf filebeat-7.9.1.tgz
filebeat/Chart.yaml
filebeat/values.yaml
filebeat/templates/NOTES.txt
filebeat/templates/_helpers.tpl
filebeat/templates/clusterrole.yaml
filebeat/templates/clusterrolebinding.yaml
filebeat/templates/configmap.yaml
filebeat/templates/daemonset.yaml
filebeat/templates/serviceaccount.yaml
filebeat/.helmignore
filebeat/Makefile
filebeat/README.md
filebeat/examples/default/Makefile
filebeat/examples/default/README.md
filebeat/examples/default/test/goss.yaml
filebeat/examples/oss/Makefile
filebeat/examples/oss/README.md
filebeat/examples/oss/test/goss.yaml
filebeat/examples/oss/values.yaml
filebeat/examples/security/Makefile
filebeat/examples/security/README.md
filebeat/examples/security/test/goss.yaml
filebeat/examples/security/values.yaml
[root@vms61 efk]# cd filebeat/
[root@vms61 filebeat]# ls
Chart.yaml examples Makefile README.md templates values.yaml
[root@vms61 filebeat]# cd ..
[root@vms61 efk]# scp filebeat7.9.1.tar 192.168.135.63:~
root@192.168.135.63's password:
filebeat7.9.1.tar 100% 437MB 67.7MB/s 00:06
[root@vms61 efk]# scp filebeat7.9.1.tar 192.168.135.62:~
root@192.168.135.62's password:
filebeat7.9.1.tar 100% 437MB 75.9MB/s 00:05
[root@vms61 efk]# docker load -i filebeat7.9.1.tar
安装成功[root@vms61 filebeat]# helm install fb .
NAME: fb
LAST DEPLOYED: Sat Oct 17 17:21:11 2020
NAMESPACE: chap11-helm
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
1. Watch all containers come up.
$ kubectl get pods --namespace=chap11-helm -l app=fb-filebeat -w
[root@vms61 filebeat]# kubectl get pods
NAME READY STATUS RESTARTS AGE
elasticsearch-master-0 1/1 Running 0 9m45s
elasticsearch-master-1 1/1 Running 0 9m45s
fb-filebeat-5k777 1/1 Running 0 28s
fb-filebeat-h2zhl 1/1 Running 0 28sMetricbeat
同前面，tar zxvf metricbeat-7.9.1.tgz解压，然后scp metricbeat7.9.1.tar到另外两个节点，并且三个节点同时导入镜像
Kibana
跟前面的操作一样，导入镜像
改成NodePort就可以映射到物理机上的某个端口然后这里需要调整机器的配置，两个worker节点需调整为4核8G内存
到此，EFK部署成功
