Logging with Elastic in Kubernetes

See docs for full recipe content.

Feature comparison of the log shippers in this repo:

Log Shipper	fluentd	fluent-bit	filebeat
rbac	x	tbd	tbd
metadata	x	tbd	tbd

Local Setup

Start a local Kubernetes using minikube

If some webpages don't show up immediately wait a bit and reload. Also the Kubernetes Dashboard needs reloading to update its view.

minikube start --memory 4096
# --vm-driver kvm

minikube dashboard
# maybe wait a bit and retry
kubectl get --all-namespaces services,pods

Extra configuration for Filebeat

minikube ssh

sudo sh -c "sed -i 's/^ExecStart=\/usr\/bin\/docker daemon.*$/& --log-opt labels=io.kubernetes.container.hash,io.kubernetes.container.name,io.kubernetes.pod.name,io.kubernetes.pod.namespace,io.kubernetes.pod.uid/' /etc/systemd/system/docker.service"

sudo systemctl daemon-reload
sudo systemctl restart docker.service

Logging with Elasticsearch and filebeat, fluentd or fluent-bit

kubectl apply \
  --filename https://raw.githubusercontent.com/giantswarm/kubernetes-elastic-stack/master/manifests-all.yaml
minikube service --namespace logging kibana
  # for index pattern in Kibana choose `filebeat-*` and `@json.time` for Time-field name
  # or `fluentd-*`
  # or `fluent-bit-*`

Turn down all logging components

kubectl delete namespace logging

To delete the whole local Kubernetes cluster use this:

minikube delete