基于Filebeat自动收集Kubernetes日志的分析系统  

Analysis System Based on Filebeat Automated Collection of Kubernetes Log

作　　者：翟雅荣 于金刚[2] ZHAI Ya-Rong;YU Jin-Gang(University of Chinese Academy of Sciences,Beijing 100049,China;Shenyang Institute of Computing Technology,Chinese Academy of Sciences,Shenyang 110168,China)

机构地区：[1]中国科学院大学,北京100049 [2]中国科学院沈阳计算技术研究所,沈阳110168

出　　处：《计算机系统应用》2018年第9期81-86,共6页Computer Systems & Applications

摘　　要：Docker容器产生的日志分散在不同的相互隔离的容器中,并且容器具有即用即销的特点,传统的解决方式是将日志文件挂载到宿主机上,但是容器经常会漂移,给日志的统一查看带来挑战,并且传统的Docker容器集群日志分析系统存在扩展性弱、效率低下等问题.本文采用Kubernetes实现容器管理、服务发现及调度,使用Filebeat采集容器及宿主机上的日志文件,并使用Redis作为缓存,Logstash转发,使用主流的开源日志收集系统ELK实现日志的存储、查看、检索.该系统具有可靠性、可扩展性等特点,提高运维人员的工作效率.The logs generated by Docker containers are scattered in different isolated containers, and the container has the characteristics of ＂ready to use＂. The traditional solution is to mount the log files to the host, but the containers often drift,bringing challenges to the unified view of the log, while the traditional Docker container log analysis system has the problems of weak expansibility and low efficiency. This study uses Kubernetes to implement container management,service discovery and scheduling, uses Filebeat to collect log files on containers and host computers, Redis as a cache,Logstash forwarding, and uses the mainstream open source log collection system ELK to store, view, and retrieve log. The system has the characteristics of real time, reliability and extensibility, and improves the efficiency of operation and maintenance personnel.

关 键 词：日志收集与分析 Kubernetes Filebeat DOCKER ELK 

分 类 号：TP311.52[自动化与计算机技术—计算机软件与理论]