{"id":93294,"date":"2020-09-05T07:42:58","date_gmt":"2020-09-05T05:42:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/logirovanie-v-kubernetes-kak-sobirat-hranit-parsit-i-obrabatyvat-logi"},"modified":"2020-09-05T07:42:58","modified_gmt":"2020-09-05T05:42:58","slug":"logirovanie-v-kubernetes-kak-sobirat-hranit-parsit-i-obrabatyvat-logi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/logirovanie-v-kubernetes-kak-sobirat-hranit-parsit-i-obrabatyvat-logi","title":{"rendered":"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Let's dive into the basics of logging in Docker and Kubernetes, and then explore two tools that can confidently be used in production: Grafana Loki and the EFK stack (Elasticsearch + Fluent Bit + Kibana).<\/p>\n<p><\/p>\n<p><em>The material of this article is a summary of <noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/nkmP0-EDb1A\">an open lecture from the \"Slurm\" school<\/a><\/noindex>. If there is a desire, and especially a production necessity, you can undergo full training \u2014 sign up for a course on <noindex><a rel=\"nofollow\" href=\"http:\/\/to.slurm.io\/Tinm9w\">Monitoring and Logging Infrastructure in Kubernetes<\/a><\/noindex>.<\/em><\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs\" src=\"\/wp-content\/uploads\/2020\/09\/565b51e95f609556ad38b9d294ef3f2f.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2 id=\"logirovanie-v-docker\">Logging in Docker<\/h2>\n<p><\/p>\n<p>At the Kubernetes level, applications run in pods, but at the lower level, they still typically operate in Docker. Therefore, it is necessary to configure logging in such a way as to collect logs from containers. Since Docker runs the containers, we need to understand how logging works at the Docker level.<\/p>\n<p><\/p>\n<p>I hope every reader knows: application logs should be written to stdout\/stderr, not inside the container. The Docker Daemon aggregates logs, and it works specifically with those logs sent to stdout\/stderr. Moreover, writing logs inside the container can lead to problems: the container bloats due to the growing log (since there is likely no Logrotate in the container), and the Docker Daemon is unaware of this log.<\/p>\n<p><\/p>\n<p>Docker has several logging drivers or plugins for collecting container logs. In the free version, Docker Community Edition (CE) has fewer logging drivers than in the commercial Docker Enterprise Edition (EE).<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs\" src=\"\/wp-content\/uploads\/2020\/09\/2b05602b54a9075f63713f72c7e74dfa.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>I have never used Docker EE in practice: at Southbridge, we strive to stick to open-source solutions, and most clients do not need the additional features of Docker EE. <\/p>\n<p><\/p>\n<p>Logging drivers in Docker CE:<\/p>\n<p><\/p>\n<p><strong>local<\/strong> \u2014 logging to internal Docker Daemon files;<br \/>\n<strong>json-file<\/strong> \u2014 creating a json-log in the directory of each container;<br \/>\n<strong>journald<\/strong> \u2014 sending logs to journald.<\/p>\n<p><\/p>\n<p>Logging settings in Docker are located in the daemon.json file. <\/p>\n<p><\/p>\n<p>In the 'log-driver' field, specify the plugin, and in the 'log-opts' field, specify its settings. In the example above, the 'json-file' plugin is indicated, with a log size limit of 'max-size': '10m'; a file count limit (rotation settings) of 'max-file': '3'; as well as values that will be attached to the logs.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs\" src=\"\/wp-content\/uploads\/2020\/09\/0b86671ee8d3d009da29ba66bc29d4eb.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Some logging driver settings can be set through the command utility. This is convenient if a particular container needs to be started with a different logging driver. <\/p>\n<p><\/p>\n<p>Here is what the logging scheme in Docker looks like:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs\" src=\"\/wp-content\/uploads\/2020\/09\/a45d8e3044780a5b7f20d83e14545d1b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>How the scheme works: the logging driver, for example, json-file, creates files. Log collectors (Rsyslog, Fluentd, Logagent, and others) collect these files and forward them for storage in Elastic, Sematext, or other storage solutions.<\/p>\n<p><\/p>\n<h2 id=\"osobennosti-logirovaniya-v-kubernetes\">Features of logging in Kubernetes<\/h2>\n<p><\/p>\n<p>Simplified, the logging scheme in Kubernetes looks like this: there is a pod, a container is running in it, and the container sends logs to stdout\/stderr. Then Docker creates a file and writes logs, which can then be rotated.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs\" src=\"\/wp-content\/uploads\/2020\/09\/76e6fdbbb9f97851bfa95a7153d8c525.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Let's consider the features of logging in Kubernetes.<\/p>\n<p><\/p>\n<p><strong>Preserving logs between deployments<\/strong>This is a mandatory condition for correct logging setup. If logs are not saved between deployments, the logs from the previous application version will be overwritten with the release of a new version, and restarting the container will also risk log loss. Kubernetes has a flag \u2014previous that allows you to view the application logs prior to the last Pod restart, but not deeper.<\/p>\n<p><\/p>\n<p><strong>Aggregating logs from all instances<\/strong>. If microservices are hosted in the cloud, the cloud provider is responsible for system monitoring. If the microservices are on your own hardware, you need to collect not only the container logs but also the system logs.<\/p>\n<p><\/p>\n<p>Previously, there were no convenient tools for collecting logs both from the system and from microservices. Usually, one tool would collect system logs (e.g., Rsyslog), and a second would collect Docker logs (e.g., journal-bit with the Docker log driver configured for journald). They tried using journal-bit to collect logs from both containers (setting the Docker log driver to write logs to journald) and from the system (in CentOS 7, systemd and journald are already available). The solution works, but it isn't perfect. If there are many logs, journal-bit starts to lag, and messages are lost.<\/p>\n<p><\/p>\n<p>The experiments continued \u2014 and another way was found. In CentOS 7, the main system logs (messages, audit, secure) are duplicated in var-log as files. In Docker, you can also configure log saving to JSON files. Accordingly, these files from CentOS 7 and Docker can be collected together.<\/p>\n<p><\/p>\n<p>Over time, the ELK Stack solution became popular. This is a combination of several tools: Elasticsearch, Logstash, and Kibana.<\/p>\n<p><\/p>\n<p>Elasticsearch stores logs from containers, Logstash collects logs from instances, and Kibana allows for processing the received logs and building graphs from them. For some time, the ELK Stack was actively used, but, in my opinion, its time is fading. I will explain later why.<\/p>\n<p><\/p>\n<p><strong>Adding metadata<\/strong>Pods, applications, and containers can run anywhere. Moreover, a single application can have multiple instances. Logs are recorded in a uniform format, but we need to understand which replica it is, which Pod is writing it, and in which namespace it resides. This is why logs need to have metadata added.<\/p>\n<p><\/p>\n<p><strong>Parsing logs<\/strong>Interestingly, the costs of supporting a logging and monitoring system can exceed the expenses of the primary application. When you have tens or hundreds of thousands of logs flying in per second, this seems reasonable, but you still need to know the limits. One way to find this limit is through log parsing. <\/p>\n<p><\/p>\n<p>Typically, it is not necessary to collect and store all logs; you should only store a portion \u2014 for example, logs with a status of 'warning' or 'error.' If we are talking about logs from nginx or ingress controllers, then only those logs with a status different from 200 should be stored. However, this is not a universal recommendation: if you are building some form of analytics on Nginx logs, then it is evident that they should be collected. <\/p>\n<p><\/p>\n<p>It is not advisable to blindly filter logs because the filtered data may not suffice for proper analytics. On the other hand, perhaps analytics should be conducted at the metrics collection level rather than at the logging level. This way, you won't have to store hundreds of thousands of lines with a 200 status code. One approach is to obtain information about traffic and errors from the metrics of ingress controllers. <\/p>\n<p><\/p>\n<p>In general, you need to think carefully about what you want to store and how long; otherwise, you may end up in a situation where the logging system consumes more resources than the main project.<\/p>\n<p><\/p>\n<p><strong>There is currently no standard solution for logging<\/strong>. Unlike monitoring, where there is one most common solution, Prometheus, logging does not have a standard. <\/p>\n<p><\/p>\n<p>In this lecture, we will examine two tools: one popular and the other gaining popularity. Aside from these, there are others, but we will not address them in this article.<\/p>\n<p><\/p>\n<p>Considering all the aforementioned features, logging in Kubernetes can now be visualized in the following diagram:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs\" src=\"\/wp-content\/uploads\/2020\/09\/81f4989c1fb7b1a4ac37524db76fd4e4.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>The container log remains, rotation is in place, but an agent collector appears, which picks up logs and sends them for storage (in the diagram \u2014 to the Logging Backend). The agent operates on each node and is typically running in Kubernetes.<\/p>\n<p><\/p>\n<p>Now let's look at the tools for logging.<\/p>\n<p><\/p>\n<h2 id=\"grafana-loki\">\u2014 our new log aggregation system, which helped confirm that all ingesters behaved appropriately during and after the failure.<\/h2>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/grafana.com\/oss\/loki\/\">\u2014 our new log aggregation system, which helped confirm that all ingesters behaved appropriately during and after the failure.<\/a><\/noindex> has recently emerged but has already become quite well known. Its advantages include easy installation, low resource consumption, and no need to install Elasticsearch since it stores data in a TSDB (time series database). In the previous article, I mentioned that Prometheus stores data in such a database, and this is one of the many similarities between the two products. The developers even claim that Loki is 'Prometheus for the world of logging.'<\/p>\n<p><\/p>\n<p>A brief digression about TSDB for those who haven't read about it. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/southbridge\/blog\/516748\/\">the previous article<\/a><\/noindex>: TSDB is excellent for storing a large amount of data in time series but is not intended for long-term storage. If for some reason you need to keep logs for more than two weeks, it's better to set up their transfer to another database.<\/p>\n<p><\/p>\n<p>Another advantage of Loki is that for data visualization, Grafana is used. It's very convenient: in Grafana, we can view monitoring data and there connect to Loki to see logs. Graphs can be built from logs.<\/p>\n<p><\/p>\n<p>The architecture of Loki looks approximately like this: <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs\" src=\"\/wp-content\/uploads\/2020\/09\/8e4ed48dbb84b7813b96728b9efddcec.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A DaemonSet deploys an agent\u2014Promtail or Fluent Bit\u2014on all servers in the cluster. The agent collects logs. Loki retrieves them and stores them in TSDB. Metadata is immediately added to the logs, which is convenient: you can filter by Pods, namespaces, container names, and even labels.<\/p>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/grafana.com\/docs\/loki\/latest\/installation\/\">Installation instructions for Loki<\/a><\/noindex><\/p>\n<p><\/p>\n<p>Loki works in the familiar Grafana interface. Loki even has its own query language, called LogQL, which resembles PromQL in Prometheus in name and syntax. The Loki interface provides query suggestions, so there's no need to memorize them.<\/p>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/grafana.com\/docs\/loki\/latest\/logql\/\">Documentation for the LogQL language<\/a><\/noindex><\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs\" src=\"\/wp-content\/uploads\/2020\/09\/acd3028fa181604be4523096d87e48cb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<em>Loki in the Grafana interface<\/em><\/p>\n<p><\/p>\n<p>Using filters, Loki allows you to find codes (like '400', '404', and any others); view logs from the entire node; and filter all logs containing the word 'error'. Clicking on a log reveals a card with all event information.<\/p>\n<p><\/p>\n<p>Loki has enough tools that allow you to extract the necessary logs, although honestly, there could technically be more. Loki is currently actively developing and gaining popularity. <\/p>\n<p><\/p>\n<h2 id=\"elastic--fluent-bit--kibana-efk-stack\">Elastic + Fluent Bit + Kibana (EFK Stack)<\/h2>\n<p><\/p>\n<p>The EFK stack is a more classic, yet equally popular logging tool. <\/p>\n<p><\/p>\n<p>At the beginning of the article, ELK (Elasticsearch + Logstash + Kibana) was mentioned, but this stack has become outdated due to the resource-intensive and not very performant Logstash. Instead, a lighter and more efficient solution called <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.fluentbit.io\/manual\/about\/what-is-fluent-bit\">Fluent Bit<\/a><\/noindex> has emerged as an even lighter and more efficient data collector. <\/p>\n<p><\/p>\n<p>According to the developers, Fluent Bit is over 100 times more performant than Fluentd: \"where Fluentd consumes 20 MB of RAM, Fluent Bit will consume 150 KB\" \u2014 a direct quote from the documentation. Given this, Fluent Bit has become more widely adopted.<\/p>\n<p><\/p>\n<p>Fluent Bit has fewer capabilities than Fluentd, but it addresses the primary needs, which is why we mainly use Fluent Bit.<\/p>\n<p><\/p>\n<p>The EFK stack operates as follows: the agent collects logs from all pods (typically, this is a DaemonSet running on all cluster servers) and sends them to storage (Elasticsearch, PostgreSQL, or Kafka). Kibana connects to the storage to retrieve all the necessary information.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs\" src=\"\/wp-content\/uploads\/2020\/09\/cd5101637d30ab1e5f019fa424147023.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/kibana\">Kibana<\/a><\/noindex> It presents the information in a user-friendly web interface. There are graphs, filters, and much more.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs\" src=\"\/wp-content\/uploads\/2020\/09\/523a219739b6e7641694b240c61a15d6.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>You can create entire dashboards from the logs.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs\" src=\"\/wp-content\/uploads\/2020\/09\/21b580f8b4871bdda64692563f53303e.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<h2 id=\"vozmozhnosti-fluent-bit\">Capabilities of Fluent Bit<\/h2>\n<p><\/p>\n<p>As Fluent Bit is generally less known than Logstash, let's examine it in more detail. Fluent Bit can logically be divided into 6 modules, with some modules supporting plugins that extend Fluent Bit's functionality.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Logging in Kubernetes: How to Collect, Store, Parse, and Process Logs\" src=\"\/wp-content\/uploads\/2020\/09\/f95a642aad7f5d291e05d8a17d1aaadc.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>Input Module<\/strong> collects logs from files, systemd services, and even tcp-sockets (you just need to specify the endpoint, and Fluent Bit will start accessing it). These capabilities are sufficient to collect logs from both the system and containers.<\/p>\n<p><\/p>\n<p>In production, we most often use plugins <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.fluentbit.io\/manual\/pipeline\/inputs\/tail\">tail<\/a><\/noindex> (you can point it at a folder with logs) and <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.fluentbit.io\/manual\/pipeline\/inputs\/systemd\">systemd<\/a><\/noindex> (you can specify which services to collect logs from).<\/p>\n<p><\/p>\n<p><strong>Parser Module<\/strong> standardizes the logs. By default, Nginx logs are strings. Using a plugin, you can convert this string into JSON: specifying fields and their values. Working with JSON is much easier than with string logs, as it allows for more flexible sorting options.<\/p>\n<p><\/p>\n<p><strong>Filter Module<\/strong>. At this level, unnecessary logs are filtered out. For example, only logs with a \"warning\" value or certain labels are sent for storage. The selected logs are buffered.<\/p>\n<p><\/p>\n<p><strong>Buffer Module<\/strong>Fluent Bit has two types of buffers: a memory buffer and a disk buffer. A buffer is a temporary storage for logs needed in case of errors or failures. Everyone wants to save on RAM, so a disk buffer is usually chosen. However, it is important to keep in mind that before logging goes to disk, it is still unloaded into memory.<\/p>\n<p><\/p>\n<p><strong>Routing\/Output Module<\/strong> contains the rules and addresses for sending logs. As mentioned, logs can be sent to Elasticsearch, PostgreSQL, or, for example, Kafka. <\/p>\n<p><\/p>\n<p>Interestingly, logs can be sent from Fluent Bit to Fluentd. Since the former is more lightweight and less functional, it can gather logs and send them to Fluentd, where they can be further processed and sent to storage with the help of additional plugins.<\/p>\n<p><\/p>\n<blockquote><p>If you plan to use Elasticsearch...<\/p>\n<p>Finally, two tips for those who plan to use Elasticsearch as a log storage in production. <\/p>\n<ol>\n<li>Set up alerts using <noindex><a rel=\"nofollow\" href=\"https:\/\/elastalert.readthedocs.io\/en\/latest\/\">ElastAlert<\/a><\/noindex>. This program extracts important messages from the general log stream and creates alerts via email or another channel. However, not so long ago there was a <em><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Yelp\/elastalert\/issues\/2911\">sad news that the project may soon cease to exist.<\/a><\/noindex><\/em>.<\/li>\n<li>Rotate logs using the application <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/client\/curator\/5.8\/index.html\">Curator<\/a><\/noindex> or by calling the Elasticsearch API. Elastic, in general, is currently making significant strides in managing index lifecycles without using third-party tools. Overall, there is no sense in storing logs for too long: it is unlikely that any log will be needed after two weeks \u2014 if it's truly critical, it will definitely have been processed within that time. As a last resort, old logs can be archived and sent somewhere for long-term storage. I have heard of special logs that must be kept by law for up to 5 years. Personally, I have not encountered such a situation, but I would not equate this information to regular logs, and I might even store them separately.<\/li>\n<\/ol>\n<p>\n<\/p><\/blockquote>\n<p>To be continued...<\/p>\n<p><\/p>\n<p><em>Author: Marsel Ibryaev, certified Kubernetes administrator, practicing engineer at <noindex><a rel=\"nofollow\" href=\"https:\/\/to.slurm.io\/TBhTzQ\">Southbridge<\/a><\/noindex>, speaker and course developer <noindex><a rel=\"nofollow\" href=\"http:\/\/to.slurm.io\/Tinm9w\">Sleurm<\/a><\/noindex>.<\/em><\/p>\n<p>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/southbridge\/blog\/517636\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0431\u0435\u0440\u0451\u043c \u043e\u0441\u043d\u043e\u0432\u044b \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 Docker \u0438 Kubernetes, \u0430 \u0437\u0430\u0442\u0435\u043c \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0434\u0432\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0441\u043c\u0435\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d\u0435: Grafana Loki \u0438 \u0441\u0442\u0435\u043a EFK (Elasticsearch + Fluent Bit + Kibana). \u041c\u0430\u0442\u0435\u0440\u0438\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 \u0432\u044b\u0436\u0438\u043c\u043a\u0430 \u0438\u0437 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043b\u0435\u043a\u0446\u0438\u0438 \u0448\u043a\u043e\u043b\u044b \u00ab\u0421\u043b\u0451\u0440\u043c\u00bb. \u0415\u0441\u043b\u0438 \u0435\u0441\u0442\u044c \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0438 \u0442\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u0430\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0439\u0442\u0438 \u043f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 \u2014 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0439\u0442\u0435\u0441\u044c \u043d\u0430 \u043a\u0443\u0440\u0441 \u043f\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":93295,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-93294","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0431\u0435\u0440\u0451\u043c \u043e\u0441\u043d\u043e\u0432\u044b \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 Docker \u0438 Kubernetes, \u0430 \u0437\u0430\u0442\u0435\u043c \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0434\u0432\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0441\u043c\u0435\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d\u0435: Grafana Loki \u0438 \u0441\u0442\u0435\u043a EFK (Elasticsearch + Fluent Bit + Kibana)..\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/logirovanie-v-kubernetes-kak-sobirat-hranit-parsit-i-obrabatyvat-logi\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 Kubernetes: \u043a\u0430\u043a \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u044c, \u0445\u0440\u0430\u043d\u0438\u0442\u044c, \u043f\u0430\u0440\u0441\u0438\u0442\u044c \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u043b\u043e\u0433\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0431\u0435\u0440\u0451\u043c \u043e\u0441\u043d\u043e\u0432\u044b \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 Docker \u0438 Kubernetes, \u0430 \u0437\u0430\u0442\u0435\u043c \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0434\u0432\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0441\u043c\u0435\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d\u0435: Grafana Loki \u0438 \u0441\u0442\u0435\u043a EFK (Elasticsearch + Fluent Bit + Kibana)..\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/logirovanie-v-kubernetes-kak-sobirat-hranit-parsit-i-obrabatyvat-logi\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-05T05:42:58+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-05T05:42:58+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Logging in Kubernetes: how to collect, store, parse, and process logs | ProHoster","description":"We will explore the basics of logging in Docker and Kubernetes, and then look at two tools that can be safely used in production: Grafana Loki and the EFK stack (Elasticsearch + Fluent Bit + Kibana)..","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/logirovanie-v-kubernetes-kak-sobirat-hranit-parsit-i-obrabatyvat-logi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 Kubernetes: \u043a\u0430\u043a \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u044c, \u0445\u0440\u0430\u043d\u0438\u0442\u044c, \u043f\u0430\u0440\u0441\u0438\u0442\u044c \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u043b\u043e\u0433\u0438 | ProHoster","og:description":"\u0420\u0430\u0437\u0431\u0435\u0440\u0451\u043c \u043e\u0441\u043d\u043e\u0432\u044b \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 Docker \u0438 Kubernetes, \u0430 \u0437\u0430\u0442\u0435\u043c \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0434\u0432\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0441\u043c\u0435\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d\u0435: Grafana Loki \u0438 \u0441\u0442\u0435\u043a EFK (Elasticsearch + Fluent Bit + Kibana)..","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/logirovanie-v-kubernetes-kak-sobirat-hranit-parsit-i-obrabatyvat-logi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-05T05:42:58+00:00","article:modified_time":"2020-09-05T05:42:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93294","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:50:29","updated":"2022-09-27 18:43:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/93294","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=93294"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/93294\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/93295"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=93294"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=93294"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=93294"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}