介绍

官方文档：Deploy ECK in your Kubernetes cluster

Beats成员

官方 Beat 采集对象 核心优势
Filebeat 日志文件 极低的 CPU/内存占用；内建“背压感知”与“断点续传”；支持多行合并、容器日志、模块一键解析（Nginx、MySQL 等）。
Metricbeat 系统与服务指标 100+ 现成模块（CPU、内存、Redis、Kafka…）；支持指标自动发现与维度标签；可按周期分片抓取，避免雪崩。
Packetbeat 网络流量/协议 零侵入地捕获 L7 协议（HTTP、DNS、MySQL、PG…），实时生成事务级日志；适合 APM 与故障定位。
Winlogbeat Windows 事件日志 原生解析 EVTX；支持事件 ID 过滤、通道多路复用、域控级批量部署；资源消耗远低于 WMI。
Auditbeat 审计/安全事件 监控文件完整性、用户登录、进程启动、SELinux/AppArmor 事件；可与 SIEM 规则直接对接。
Heartbeat 运行状态/可用性 轻量级“黑盒探针”，支持 HTTP、TCP、ICMP、SSL 证书到期检测；可输出 Uptime SLA 与告警。

部署ECK crd

1
kubectl create -f https://download.elastic.co/downloads/eck/2.13.0/crds.yaml

部署Operator

1
kubectl apply -f https://download.elastic.co/downloads/eck/2.13.0/operator.yaml

部署ElasticSearch集群

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
cat > elasticsearch.yaml << EOF
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: elasticsearch
spec:
  version: 8.14.1
  nodeSets:
  - name: master
    count: 3
    config:
      node.store.allow_mmap: false
    podTemplate:
      spec:
        initContainers:
        - name: sysctl
          securityContext:
            privileged: true
          command: ['sh', '-c', 'sysctl -w vm.max_map_count=262144']
    volumeClaimTemplates:
    - metadata:
        name: elasticsearch-data
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 200Gi
        storageClassName: nfs-storage
EOF
1
kubectl apply -f elasticsearch.yaml

获取密码

1
kubectl get secret elasticsearch-es-elastic-user -o=jsonpath='{.data.elastic}' | base64 --decode; echo

部署kibana

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
cat > kibana.yaml << EOF
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
  name: kibana
spec:
  version: 8.14.1
  count: 1
  elasticsearchRef:
    name: elasticsearch
  podTemplate:
    spec:
      containers:
      - name: kibana
        env:
        - name: I18N_LOCALE
          value: "zh-CN"
EOF
1
kubectl apply -f kibana.yaml

访问

修改svc为NodePort或LoadBalancer

账号：elastic

密码：kubectl get secret elasticsearch-es-elastic-user -o=jsonpath='{.data.elastic}' | base64 --decode; echo

部署Beats（DaemonSet模式）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
cat > beats.yaml << EOF
apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
  name: filebeat
spec:
  type: filebeat
  version: 8.14.1
  elasticsearchRef:
    name: elasticsearch
  config:
    filebeat.inputs:
    - type: container
      paths:
      - /var/log/containers/*.log
  daemonSet:
    podTemplate:
      spec:
        dnsPolicy: ClusterFirstWithHostNet
        hostNetwork: true
        securityContext:
          runAsUser: 0
        containers:
        - name: filebeat
          volumeMounts:
          - name: varlogcontainers
            mountPath: /var/log/containers
          - name: varlogpods
            mountPath: /var/log/pods
          - name: varlibdockercontainers
            mountPath: /var/lib/docker/containers
        volumes:
        - name: varlogcontainers
          hostPath:
            path: /var/log/containers
        - name: varlogpods
          hostPath:
            path: /var/log/pods
        - name: varlibdockercontainers
          hostPath:
            path: /var/lib/docker/containers
EOF
1
kubectl apply -f beats.yaml

配置索引