{"id":93294,"date":"2020-09-05T07:42:58","date_gmt":"2020-09-05T05:42:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/logirovanie-v-kubernetes-kak-sobirat-hranit-parsit-i-obrabatyvat-logi"},"modified":"2020-09-05T07:42:58","modified_gmt":"2020-09-05T05:42:58","slug":"logirovanie-v-kubernetes-kak-sobirat-hranit-parsit-i-obrabatyvat-logi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/logirovanie-v-kubernetes-kak-sobirat-hranit-parsit-i-obrabatyvat-logi","title":{"rendered":"Logovanie v Kubernetes: ako zbiera\u0165, uchov\u00e1va\u0165, analyzova\u0165 a spracov\u00e1va\u0165 logy","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Prejdeme si z\u00e1klady logovania v Dockeri a Kubernetes a potom sa pozrieme na dve n\u00e1stroje, ktor\u00e9 sa daj\u00fa s d\u00f4verou pou\u017e\u00edva\u0165 v produkcii: Grafana Loki a stack EFK (Elasticsearch + Fluent Bit + Kibana).<\/p>\n

<\/p>\n

Materi\u00e1l \u010dl\u00e1nku \u2014 v\u00fd\u0165ah z otvorenej predn\u00e1\u0161ky \u0161koly \u201eS\u013eorm\u201c<\/a><\/noindex>. Ak m\u00e1te chu\u0165 a najm\u00e4 v\u00fdrobn\u00fa potrebu, m\u00f4\u017eete absolvova\u0165 kompletn\u00e9 \u0161kolenie \u2014 prihl\u00e1ste sa na kurz z Monitorovania a logovania infra\u0161trukt\u00fary v Kubernetes<\/a><\/noindex>.<\/em><\/p>\n

<\/p>\n

\"Logovanie<\/p>\n

<\/a><\/noindex><\/p>\n

Logovanie v Dockeri<\/h2>\n

<\/p>\n

Na \u00farovni Kubernetes s\u00fa aplik\u00e1cie spusten\u00e9 v podoch, ale na ni\u017e\u0161ej \u00farovni zvy\u010dajne funguj\u00fa v Dockeri. Preto je potrebn\u00e9 nastavi\u0165 logovanie tak, aby sa zbierali logy z kontajnerov. Kontajnery sp\u00fa\u0161\u0165a Docker \u2014 znamen\u00e1 to, \u017ee sa treba zorientova\u0165, ako je logovanie nastaven\u00e9 na \u00farovni Dockera.<\/p>\n

<\/p>\n

D\u00fafam, \u017ee ka\u017ed\u00fd \u010ditate\u013e vie: logy aplik\u00e1cie by sa mali zapisova\u0165 do stdout\/stderr, a nie dovn\u00fatra kontajnera. Logy agreguje Docker Daemon, a on pracuje pr\u00e1ve s t\u00fdmi logmi, ktor\u00e9 sa posielaj\u00fa na stdout\/stderr. Okrem toho zapisovanie logov dovn\u00fatra kontajnera prin\u00e1\u0161a probl\u00e9my: kontajner narast\u00e1 kv\u00f4li rast\u00facemu logu (ke\u010f\u017ee vo vn\u00fatri kontajnera pravdepodobne nie je \u017eiadny Logrotate), a Docker Daemon o tomto logu ani nevie.<\/p>\n

<\/p>\n

Docker m\u00e1 nieko\u013eko log-drivers alebo pluginov na zber logov kontajnerov. V bezplatnej verzii Docker Community Edition (CE) je menej log-driverov ne\u017e v komer\u010dnej Docker Enterprise Edition (EE).<\/p>\n

<\/p>\n

\"Logovanie<\/p>\n

<\/p>\n

Docker EE som nikdy nepou\u017e\u00edval v praxi: v Southbridge sa sna\u017e\u00edme dodr\u017eiava\u0165 rie\u0161enia Open Source, a v\u00e4\u010d\u0161ine na\u0161ich klientov nie s\u00fa potrebn\u00e9 \u010fal\u0161ie funkcie Docker EE. <\/p>\n

<\/p>\n

Log-drivery v Docker CE:<\/p>\n

<\/p>\n

local<\/strong> \u2014 z\u00e1pis logov do vn\u00fatorn\u00fdch s\u00faborov Docker Daemon;
\njson-file<\/strong> \u2014 vytvorenie json-logu v prie\u010dinku ka\u017ed\u00e9ho kontajnera;
\njournald<\/strong> \u2014 odosielanie logov do journald.<\/p>\n

<\/p>\n

Nastavenia logovania v Dockeri sa nach\u00e1dzaj\u00fa v s\u00fabore daemon.json. <\/p>\n

<\/p>\n

V poli \u201clog-driver\u201d uv\u00e1dzaj\u00fa plugin a v poli \u201clog-opts\u201d \u2014 jeho nastavenia. V pr\u00edklade vy\u0161\u0161ie je uveden\u00fd plugin \u201cjson-file\u201d, obmedzenie ve\u013ekosti logu \u2014 \u201cmax-size\u201d: \u201c10m\u201d; obmedzenie po\u010dtu s\u00faborov (nastavenia rot\u00e1cie) \u2014 \u201cmax-file\u201d: \u201c3\u201d; ako aj hodnoty, ktor\u00e9 sa pripoja k logom.<\/p>\n

<\/p>\n

\"Logovanie<\/p>\n

<\/p>\n

Niektor\u00e9 nastavenia log-drivery je mo\u017en\u00e9 nastavi\u0165 pomocou pr\u00edkazovej utilitky. Je to pohodln\u00e9, ak je potrebn\u00e9 spusti\u0165 samostatn\u00fd kontajner s in\u00fdm log-driverom. <\/p>\n

<\/p>\n

Tu je, ako vyzer\u00e1 sch\u00e9ma logovania v Dockeri:<\/p>\n

<\/p>\n

\"Logovanie<\/p>\n

<\/p>\n

Ako sch\u00e9ma funguje: log-driver, napr\u00edklad json-file, vytv\u00e1ra s\u00fabory. Zbierky logov (Rsyslog, Fluentd, Logagent a \u010fal\u0161ie) tieto s\u00fabory zhroma\u017e\u010fuj\u00fa a pren\u00e1\u0161aj\u00fa na ulo\u017eenie do Elastic, Sematext alebo in\u00fdch \u00falo\u017e\u00edsk.<\/p>\n

<\/p>\n

Vlastnosti logovania v Kubernetes<\/h2>\n

<\/p>\n

Zjednodu\u0161ene sch\u00e9ma logovania v Kubernetes vyzer\u00e1 takto: existuje pod, v ktorom je spusten\u00fd kontajner, kontajner posiela logy do stdout\/stderr. Potom Docker vytvor\u00ed s\u00fabor a zapisuje logy, ktor\u00e9 potom m\u00f4\u017ee rotova\u0165.<\/p>\n

<\/p>\n

\"Logovanie<\/p>\n

<\/p>\n

Pozrime sa na vlastnosti logovania v Kubernetes.<\/p>\n

<\/p>\n

Uchov\u00e1va\u0165 logy medzi nasaden\u00fdmi verziami<\/strong>. To je povinn\u00e1 podmienka pre spr\u00e1vne nastavenie logovania. Ak logy nebud\u00fa uchov\u00e1van\u00e9 medzi nasaden\u00edm, pri vydan\u00ed novej verzie aplik\u00e1cie bud\u00fa logy predch\u00e1dzaj\u00facej verzie prep\u00edsan\u00e9, re\u0161tartovanie kontajnera taktie\u017e sp\u00f4sob\u00ed stratu logov. Kubernetes m\u00e1 k\u013e\u00fa\u010d —previous, ktor\u00fd umo\u017e\u0148uje zobrazi\u0165 logy aplik\u00e1cie pred posledn\u00fdm re\u0161tartom Pod, ale nie hlb\u0161ie.<\/p>\n

<\/p>\n

Agregova\u0165 logy zo v\u0161etk\u00fdch in\u0161tanci\u00ed<\/strong>. Ak s\u00fa mikroservisy hos\u0165ovan\u00e9 v cloudov\u00fdch prostrediach, za kontrolu syst\u00e9mu zodpoved\u00e1 cloudov\u00fd poskytovate\u013e. Ak s\u00fa mikroservisy na vlastnom hardv\u00e9ri, je potrebn\u00e9 zhroma\u017e\u010fova\u0165 nielen logy z kontajnerov, ale aj logy zo syst\u00e9mu.<\/p>\n

<\/p>\n

Predt\u00fdm neexistovali pohodln\u00e9 n\u00e1stroje na zbieranie logov zo syst\u00e9mu aj z mikroservisov. Zvy\u010dajne jeden n\u00e1stroj zbieral syst\u00e9mov\u00e9 logy (napr\u00edklad Rsyslog), druh\u00fd \u2014 logy z Dockeru (napr\u00edklad journal-bit s nastaven\u00edm log-drivra Docker na journald). Sk\u00fa\u0161ali sme pou\u017e\u00edva\u0165 journal-bit \u2013 zbiera\u0165 logy aj z kontajnerov (v log-drivri Docker ur\u010di\u0165, \u017ee sa maj\u00fa logy zapisova\u0165 do journald), a zo syst\u00e9mu (v CentOS 7 u\u017e existuje systemd a journald). Rie\u0161enie je funk\u010dn\u00e9, ale nie ide\u00e1lne. Ak je logov ve\u013ea, journal-bit za\u010d\u00edna spoma\u013eova\u0165, spr\u00e1vy sa str\u00e1caj\u00fa.<\/p>\n

<\/p>\n

Experimenty pokra\u010dovali \u2014 a na\u0161iel sa in\u00fd sp\u00f4sob. V CentOS 7 sa hlavn\u00e9 syst\u00e9mov\u00e9 logy (messages, audit, secure) duplikuj\u00fa v var-logs vo forme s\u00faborov. V Dockeri je tie\u017e mo\u017en\u00e9 nastavi\u0165 uchovanie logov do s\u00faborov json. Tieto s\u00fabory z CentOS 7 a Dockeru je n\u00e1sledne mo\u017en\u00e9 zbiera\u0165 spolu.<\/p>\n

<\/p>\n

S \u010dasom sa stalo popul\u00e1rnym rie\u0161enie ELK Stack. Je to kombin\u00e1cia nieko\u013ek\u00fdch n\u00e1strojov: Elasticsearch, Logstash a Kibana.<\/p>\n

<\/p>\n

Elasticsearch uchov\u00e1va logy z kontajnerov, Logstash zhroma\u017e\u010fuje logy z in\u0161tanci\u00ed, Kibana umo\u017e\u0148uje spracov\u00e1va\u0165 z\u00edskan\u00e9 logy a vytv\u00e1ra\u0165 na ich z\u00e1klade grafy. Niektor\u00fd \u010das sa ELK Stack akt\u00edvne pou\u017e\u00edval, ale pod\u013ea m\u00f4jho n\u00e1zoru mu vypr\u0161al \u010das. Nesk\u00f4r vysvetl\u00edm, pre\u010do.<\/p>\n

<\/p>\n

Prida\u0165 metadata<\/strong>. Pody, aplik\u00e1cie, kontajnery m\u00f4\u017eu by\u0165 spusten\u00e9 kdeko\u013evek. Navy\u0161e, jedno aplika\u010dn\u00e9 mo\u017eno ma\u0165 viacero in\u0161tanci\u00ed. Logy s\u00fa zaznamenan\u00e9 v jednom form\u00e1te, a my mus\u00edme pochopi\u0165, ktor\u00e1 replika to je, ktor\u00fd Pod to p\u00ed\u0161e, v akom namespace sa nach\u00e1dza. Preto je potrebn\u00e9 prida\u0165 k logom metadata.<\/p>\n

<\/p>\n

Z\u00edskava\u0165 logy<\/strong>. Zauj\u00edmav\u00e9, ale n\u00e1klady na podporu syst\u00e9mu logovania a monitorovania m\u00f4\u017eu prekro\u010di\u0165 n\u00e1klady na samotn\u00fa aplik\u00e1ciu. Ke\u010f v\u00e1m prich\u00e1dzaj\u00fa desiatky a stovky tis\u00edc logov za sekundu, zd\u00e1 sa to by\u0165 prirodzen\u00e9, no st\u00e1le je potrebn\u00e9 pozna\u0165 hranicu. Jeden zo sp\u00f4sobov, ako t\u00fato hranicu n\u00e1js\u0165, je parsovanie logov. <\/p>\n

<\/p>\n

Vo v\u0161eobecnosti nie je potrebn\u00e9 zhroma\u017e\u010fova\u0165 a uchov\u00e1va\u0165 v\u0161etky logy, treba posiela\u0165 na uchov\u00e1vanie iba \u010das\u0165 \u2014 napr\u00edklad logy so statusom \u201ewarning\u201c alebo \u201eerror\u201c. Ak ide o logy nginx alebo ingress-kontrol\u00e9rov, je mo\u017en\u00e9 uchov\u00e1va\u0165 iba tie, ktor\u00fdch status nie je 200. Ale to nie je univerz\u00e1lny poradca: ak budujete anal\u00fdzu na z\u00e1klade logov Nginx, je jasn\u00e9, \u017ee by ste ich mali zbiera\u0165. <\/p>\n

<\/p>\n

Ned\u00e1vaj\u00fa zl\u00fd filter na logy, preto\u017ee odfiltrovan\u00e9 \u00fadaje nemusia sta\u010di\u0165 na norm\u00e1lnu anal\u00fdzu. Na druhej strane, mo\u017eno by analytiku bolo lep\u0161ie vykon\u00e1va\u0165 na \u00farovni zbierania metrick\u00fdch \u00fadajov. Potom nebude potrebn\u00e9 uchov\u00e1va\u0165 stovky tis\u00edc riadkov s k\u00f3dom 200. Jeden z pr\u00edstupov je z\u00edskava\u0165 inform\u00e1cie o prenose a chyb\u00e1ch z metrick\u00fdch \u00fadajov ingress-kontrol\u00e9rov. <\/p>\n

<\/p>\n

Vo v\u0161eobecnosti, treba d\u00f4kladne zv\u00e1\u017ei\u0165: \u010do chcete uchov\u00e1va\u0165 a ako dlho, preto\u017ee inak nastane situ\u00e1cia, ke\u010f syst\u00e9m logovania zaber\u00e1 viac zdrojov ne\u017e hlavn\u00fd projekt.<\/p>\n

<\/p>\n

Zatia\u013e neexistuje \u0161tandardn\u00e9 rie\u0161enie pre logovanie<\/strong>. Na rozdiel od monitorovania, kde existuje jedno najbe\u017enej\u0161ie rie\u0161enie Prometheus, v logovan\u00ed nie je \u017eiadny \u0161tandard. <\/p>\n

<\/p>\n

V r\u00e1mci tejto predn\u00e1\u0161ky sa pozrieme na dva n\u00e1stroje: jeden popul\u00e1rny a druh\u00fd \u2014 z\u00edskavaj\u00faci na popularite. Okrem nich existuj\u00fa aj in\u00e9, ale v tomto \u010dl\u00e1nku sa ich dotkneme.<\/p>\n

<\/p>\n

S prihliadnut\u00edm na v\u0161etky vy\u0161\u0161ie uveden\u00e9 vlastnosti m\u00f4\u017eeme teraz predstavi\u0165 logovanie v Kubernetes na nasleduj\u00facej sch\u00e9me:<\/p>\n

<\/p>\n

\"Logovanie<\/p>\n

<\/p>\n

Zost\u00e1va log kontajnera, rot\u00e1cia, ale objav\u00ed sa agent-zberate\u013e, ktor\u00fd zhroma\u017e\u010fuje logy a posiela ich na uchov\u00e1vanie (na sch\u00e9me \u2014 do Logging Backend). Agent pracuje na ka\u017edej node a zvy\u010dajne je spusten\u00fd v Kubernetes.<\/p>\n

<\/p>\n

Teraz si pozrieme n\u00e1stroje na logovanie.<\/p>\n

<\/p>\n

Grafana Loki<\/h2>\n

<\/p>\n

Grafana Loki<\/a><\/noindex> sa objavil ned\u00e1vno, no u\u017e sa stal dos\u0165 zn\u00e1mym. Jeho v\u00fdhody: \u013eahko sa in\u0161taluje, spotreb\u00fava m\u00e1lo zdrojov, nevy\u017eaduje in\u0161tal\u00e1ciu Elasticsearch, preto\u017ee uchov\u00e1va \u00fadaje v TSDB (\u010dasovej datab\u00e1ze). V predch\u00e1dzaj\u00facom \u010dl\u00e1nku som p\u00edsal, \u017ee v takej datab\u00e1ze uchov\u00e1va \u00fadaje Prometheus, a to je jedna z mnoh\u00fdch podobnost\u00ed t\u00fdchto dvoch produktov. V\u00fdvoj\u00e1ri dokonca tvrdia, \u017ee Loki je \"Prometheus pre svet logovania\".<\/p>\n

<\/p>\n

Mal\u00e9 odbo\u010denie k TSDB pre t\u00fdch, ktor\u00ed ne\u010d\u00edtali predch\u00e1dzaj\u00faci \u010dl\u00e1nok<\/a><\/noindex>: TSDB sa v\u00fdborne vyrovn\u00e1va so skladovan\u00edm ve\u013ek\u00e9ho mno\u017estva \u00fadajov, \u010dasov\u00fdch radov, ale nie je ur\u010den\u00e1 na dlhodob\u00e9 uchov\u00e1vanie. Ak z nejak\u00e9ho d\u00f4vodu potrebujete uchov\u00e1va\u0165 logy dlh\u0161ie ako dva t\u00fd\u017edne, je lep\u0161ie nastavi\u0165 ich prenos do inej datab\u00e1zy.<\/p>\n

<\/p>\n

\u010eal\u0161ia v\u00fdhoda Loki - na vizualiz\u00e1ciu \u00fadajov sa pou\u017e\u00edva Grafana. Ve\u013emi praktick\u00e9: v Grafane sledujeme \u00fadaje zo sledovania a tam tie\u017e, pripojen\u00edm Loki, sledujeme logy. Na z\u00e1klade logov m\u00f4\u017eeme vytv\u00e1ra\u0165 grafy.<\/p>\n

<\/p>\n

Architekt\u00fara Loki vyzer\u00e1 pribli\u017ene takto: <\/p>\n

<\/p>\n

\"Logovanie<\/p>\n

<\/p>\n

Pomocou DaemonSet sa na v\u0161etk\u00fdch serveroch klastru rozv\u00edja agent - Promtail alebo Fluent Bit. Agent zbiera logy. Loki ich preber\u00e1 a uchov\u00e1va v TSDB. K logom sa okam\u017eite prid\u00e1vaj\u00fa metadata, \u010do je praktick\u00e9: m\u00f4\u017eete filtrova\u0165 pod\u013ea Pods, namespaces, mien kontajnerov a dokonca aj pod\u013ea \u0161t\u00edtkov.<\/p>\n

<\/p>\n

N\u00e1vod na in\u0161tal\u00e1ciu Loki<\/a><\/noindex><\/p>\n

<\/p>\n

Loki funguje v zn\u00e1mom rozhran\u00ed Grafana. Loki m\u00e1 dokonca svoj vlastn\u00fd jazyk dotazov, ktor\u00fd sa naz\u00fdva LogQL - n\u00e1zov a syntax pripom\u00ednaj\u00fa PromQL v Prometheovi. V rozhran\u00ed Loki s\u00fa n\u00e1povedy s dotazmi, tak\u017ee ich nemus\u00edte pozna\u0165 naspam\u00e4\u0165.<\/p>\n

<\/p>\n

Dokument\u00e1cia k jazyku LogQL<\/a><\/noindex><\/p>\n

<\/p>\n

\"Logovanie
\nLoki v rozhran\u00ed Grafana<\/em><\/p>\n

<\/p>\n

Pou\u017eit\u00edm filtrov v Loki m\u00f4\u017eete n\u00e1js\u0165 k\u00f3dy (\"400\", \"404\" a ak\u00fdko\u013evek in\u00fd); pozrie\u0165 logy z celej nody; filtrova\u0165 v\u0161etky logy, kde je slovo \"error\". Ak kliknete na log, otvor\u00ed sa karta so v\u0161etk\u00fdmi inform\u00e1ciami o udalosti.<\/p>\n

<\/p>\n

V Loki je dostatok n\u00e1strojov, ktor\u00e9 umo\u017e\u0148uj\u00fa vyh\u013ead\u00e1va\u0165 potrebn\u00e9 logy, i ke\u010f \u00faprimne, technicky by ich mohlo by\u0165 aj viac. Teraz sa Loki akt\u00edvne vyv\u00edja a z\u00edska popularitu. <\/p>\n

<\/p>\n

Elastic + Fluent Bit + Kibana (EFK Stack)<\/h2>\n

<\/p>\n

Stack EFK je klasickej\u0161\u00ed a z\u00e1rove\u0148 rovnako popul\u00e1rny n\u00e1stroj na logovanie. <\/p>\n

<\/p>\n

Na za\u010diatku \u010dl\u00e1nku sa spom\u00ednal ELK (Elasticsearch + Logstash + Kibana), ale tento stack zastar\u00e1va kv\u00f4li m\u00e1lo v\u00fdkonn\u00e9mu a pritom zdrojovo n\u00e1ro\u010dn\u00e9mu Logstash. Namiesto neho sa za\u010dal pou\u017e\u00edva\u0165 \u013eah\u0161\u00ed a v\u00fdkonn\u00fd Fluentd, a o nie\u010do nesk\u00f4r mu na pomoc pri\u0161iel Fluent Bit<\/a><\/noindex> \u2014 e\u0161te \u013eah\u0161\u00ed a e\u0161te v\u00fdkonn\u00e9 agent na zber d\u00e1t. <\/p>\n

<\/p>\n

Ak ver\u00edme v\u00fdvoj\u00e1rom, Fluent Bit je viac ako 100-kr\u00e1t lep\u0161\u00ed z poh\u013eadu v\u00fdkonu ako Fluentd: \u201ekde Fluentd spotrebuje 20 MB RAM, Fluent Bit bude spotrebov\u00e1va\u0165 150 KB\u201c \u2014 priama cit\u00e1cia z dokument\u00e1cie. Pozn\u00e1vaj\u00fac toto, sa Fluent Bit za\u010dne pou\u017e\u00edva\u0165 \u010dastej\u0161ie.<\/p>\n

<\/p>\n

Fluent Bit m\u00e1 menej mo\u017enost\u00ed ako Fluentd, ale z\u00e1kladn\u00e9 po\u017eiadavky pokr\u00fdva, tak\u017ee v\u00e4\u010d\u0161inou pou\u017e\u00edvame Fluent Bit.<\/p>\n

<\/p>\n

Sch\u00e9ma fungovania stacku EFK: agent zbiera logy zo v\u0161etk\u00fdch podov (zvy\u010dajne ide o DaemonSet, ktor\u00fd je spusten\u00fd na v\u0161etk\u00fdch serveroch klastrov) a posiela ich do \u00falo\u017eiska (Elasticsearch, PostgreSQL alebo Kafka). Kibana sa prip\u00e1ja k \u00falo\u017eisku a z\u00edskava odtia\u013e v\u0161etky potrebn\u00e9 inform\u00e1cie.<\/p>\n

<\/p>\n

\"Logovanie<\/p>\n

<\/p>\n

Kibana<\/a><\/noindex> predstavuje inform\u00e1cie v pohodlnom webovom rozhran\u00ed. S\u00fa tam grafy, filtre a mnoh\u00e9 \u010fal\u0161ie.<\/p>\n

<\/p>\n

\"Logovanie<\/p>\n

<\/p>\n

Na z\u00e1klade logov je mo\u017en\u00e9 vytv\u00e1ra\u0165 cel\u00e9 dashboardy.<\/p>\n

<\/p>\n

\"Logovanie<\/p>\n

<\/p>\n

Mo\u017enosti Fluent Bit<\/h2>\n

<\/p>\n

Ke\u010f\u017ee o Fluent Bit sa zvy\u010dajne po\u010dulo menej ako o Logstash, pozrime sa na neho podrobnej\u0161ie. Fluent Bit je logicky rozdelen\u00fd do 6 modulov, na niektor\u00e9 moduly je mo\u017en\u00e9 prida\u0165 pluginy, ktor\u00e9 roz\u0161iruj\u00fa mo\u017enosti Fluent Bit.<\/p>\n

<\/p>\n

\"Logovanie<\/p>\n

<\/p>\n

Modul Input<\/strong> zbiera logy z s\u00faborov, slu\u017eieb systemd a dokonca aj z tcp-socket (sta\u010d\u00ed len ur\u010di\u0165 endpoint a Fluent Bit za\u010dne tam chodi\u0165). Tieto mo\u017enosti s\u00fa dostato\u010dn\u00e9 na zbieranie logov zo syst\u00e9mu aj z kontajnerov.<\/p>\n

<\/p>\n

V produkcii naj\u010dastej\u0161ie pou\u017e\u00edvame pluginy tail<\/a><\/noindex> (m\u00f4\u017ee by\u0165 nasmerovan\u00fd na prie\u010dinok s logami) a systemd<\/a><\/noindex> (m\u00f4\u017ee mu by\u0165 povedan\u00e9, z ktor\u00fdch slu\u017eieb zbiera\u0165 logy).<\/p>\n

<\/p>\n

Modul Parser<\/strong> privedie logy do jednotn\u00e9ho form\u00e1tu. Predvolene s\u00fa logy Nginx reprezentovan\u00e9 ako re\u0165azec. Pomocou pluginu je mo\u017en\u00e9 tento re\u0165azec transformova\u0165 do form\u00e1tu JSON: nastavi\u0165 polia a ich hodnoty. S JSON je ove\u013ea jednoduch\u0161ie pracova\u0165 ako s re\u0165azcov\u00fdm logom, preto\u017ee existuj\u00fa flexibilnej\u0161ie mo\u017enosti triedenia.<\/p>\n

<\/p>\n

Modul Filter<\/strong>. Na tejto \u00farovni sa triedia nepotrebn\u00e9 logy. Napr\u00edklad na uchovanie sa odosielaj\u00fa logy iba s hodnotou \u201ewarning\u201c alebo s ur\u010dit\u00fdmi \u0161t\u00edtkami. Vybran\u00e9 logy sa ukladaj\u00fa do bufferu.<\/p>\n

<\/p>\n

Modul Buffer<\/strong>. Fluent Bit m\u00e1 dva typy vyrovn\u00e1vac\u00edch pam\u011bt\u00ed: pam\u011b\u0165ovou a diskovou. Vyrovn\u00e1vac\u00ed pam\u011b\u0165 je do\u010dasn\u00e9 \u00falo\u017ei\u0161t\u011b log\u016f, kter\u00e9 je pot\u0159eba v p\u0159\u00edpad\u011b chyb nebo selh\u00e1n\u00ed. Ka\u017ed\u00fd chce \u0161et\u0159it opera\u010dn\u00ed pam\u011b\u0165, proto se obvykle vol\u00ed diskov\u00e1 vyrovn\u00e1vac\u00ed pam\u011b\u0165. Je v\u0161ak t\u0159eba br\u00e1t v \u00favahu, \u017ee logy se p\u0159ed ulo\u017een\u00edm na disk stejn\u011b na\u010d\u00edtaj\u00ed do pam\u011bti.<\/p>\n

<\/p>\n

Modul Routing\/Output<\/strong> obsahuje pravidla a adresy pro odes\u00edl\u00e1n\u00ed log\u016f. Jak ji\u017e bylo zm\u00edn\u011bno, logy lze odes\u00edlat do Elasticsearch, PostgreSQL nebo nap\u0159\u00edklad Kafka. <\/p>\n

<\/p>\n

Zaj\u00edmav\u00e9 je, \u017ee z Fluent Bit lze logy odes\u00edlat do Fluentd. Proto\u017ee prvn\u00ed zp\u016fsob je leh\u010d\u00ed a m\u00e9n\u011b funk\u010dn\u00ed, p\u0159es n\u011bj je mo\u017en\u00e9 sb\u00edrat logy a odes\u00edlat je do Fluentd, kde je pomoc\u00ed dal\u0161\u00edch plugin\u016f d\u00e1le zpracov\u00e1vat a odes\u00edlat do \u00falo\u017ei\u0161\u0165.<\/p>\n

<\/p>\n

Pokud pl\u00e1nujete pou\u017e\u00edvat Elasticsearch\u2026<\/p>\n

Na z\u00e1v\u011br dva tipy pro ty, kdo pl\u00e1nuj\u00ed pou\u017e\u00edvat Elasticsearch jako \u00falo\u017ei\u0161t\u011b log\u016f v produk\u010dn\u00edm prost\u0159ed\u00ed. <\/p>\n

    \n
  1. Nastavte upozorn\u011bn\u00ed pomoc\u00ed ElastAlert<\/a><\/noindex>. Tento program vy\u010dle\u0148uje z celkov\u00e9ho toku log\u016f d\u016fle\u017eit\u00e9 zpr\u00e1vy a pos\u00edl\u00e1 na n\u011b upozorn\u011bn\u00ed na e-mail nebo do jin\u00e9ho kan\u00e1lu. Bohu\u017eel, ned\u00e1vno p\u0159i\u0161la smutn\u00e1 zpr\u00e1va, \u017ee projekt m\u016f\u017ee brzy p\u0159estat existovat.<\/a><\/noindex><\/em>.<\/li>\n
  2. Rotujte logy pomoc\u00ed aplikace Curator<\/a><\/noindex> nebo vol\u00e1n\u00edm API Elasticsearch. Samotn\u00fd Elastic nyn\u00ed \u010din\u00ed v\u00fdznamn\u00e9 kroky k \u0159\u00edzen\u00ed \u017eivotn\u00edho cyklu index\u016f bez pou\u017eit\u00ed extern\u00edch n\u00e1stroj\u016f. V z\u00e1sad\u011b nem\u00e1 smysl uchov\u00e1vat logy dlouho: je nepravd\u011bpodobn\u00e9, \u017ee by n\u011bjak\u00fd log byl pot\u0159ebn\u00fd po dvou t\u00fddnech \u2014 pokud je skute\u010dn\u011b kritick\u00fd, za dv\u011b t\u00fddny bude jist\u011b zpracov\u00e1n. V krajn\u00edm p\u0159\u00edpad\u011b lze star\u00e9 logy archivovat a odes\u00edlat n\u011bkam na dlouhodob\u00e9 uchov\u00e1v\u00e1n\u00ed. Sly\u0161el jsem o speci\u00e1ln\u00edch log\u00e1ch, kter\u00e9 je podle z\u00e1kona nutn\u00e9 uchov\u00e1vat a\u017e 5 let. Osobn\u011b jsem se s t\u00edm nesetkal, ale podobn\u00e9 informace bych nepova\u017eoval za b\u011b\u017en\u00e9 logy a mo\u017en\u00e1 bych je dokonce uchov\u00e1val odd\u011blen\u011b.<\/li>\n<\/ol>\n

    \n<\/p><\/blockquote>\n

    Pokra\u010dovanie nasleduje…<\/p>\n

    <\/p>\n

    Autor: Marcel Ibraev, certifikovan\u00fd administr\u00e1tor Kubernetes, praktikuj\u00edc\u00ed in\u017een\u00fdr ve spole\u010dnosti Southbridge<\/a><\/noindex>, \u0159e\u010dn\u00edk a autor kurz\u016f Slurm<\/a><\/noindex>.<\/em><\/p>\n

    Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0420\u0430\u0437\u0431\u0435\u0440\u0451\u043c \u043e\u0441\u043d\u043e\u0432\u044b \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 Docker \u0438 Kubernetes, \u0430 \u0437\u0430\u0442\u0435\u043c \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0434\u0432\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0441\u043c\u0435\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d\u0435: Grafana Loki \u0438 \u0441\u0442\u0435\u043a EFK (Elasticsearch + Fluent Bit + Kibana). \u041c\u0430\u0442\u0435\u0440\u0438\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 \u0432\u044b\u0436\u0438\u043c\u043a\u0430 \u0438\u0437 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043b\u0435\u043a\u0446\u0438\u0438 \u0448\u043a\u043e\u043b\u044b \u00ab\u0421\u043b\u0451\u0440\u043c\u00bb. \u0415\u0441\u043b\u0438 \u0435\u0441\u0442\u044c \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0438 \u0442\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u0430\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0439\u0442\u0438 \u043f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 \u2014 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0439\u0442\u0435\u0441\u044c \u043d\u0430 \u043a\u0443\u0440\u0441 \u043f\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":93295,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-93294","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zaznamen\u00e1vanie v Kubernetes: ako zbiera\u0165, uchov\u00e1va\u0165, analyzova\u0165 a spracov\u00e1va\u0165 logy | ProHoster","description":"Probereme z\u00e1klady logov\u00e1n\u00ed v Dockeru a Kubernetes a pot\u00e9 se pod\u00edv\u00e1me na dva n\u00e1stroje, kter\u00e9 lze bezpe\u010dn\u011b pou\u017e\u00edvat v produk\u010dn\u00edm prost\u0159ed\u00ed: Grafana Loki a stack EFK (Elasticsearch + Fluent Bit + Kibana)..","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/logirovanie-v-kubernetes-kak-sobirat-hranit-parsit-i-obrabatyvat-logi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 Kubernetes: \u043a\u0430\u043a \u0441\u043e\u0431\u0438\u0440\u0430\u0442\u044c, \u0445\u0440\u0430\u043d\u0438\u0442\u044c, \u043f\u0430\u0440\u0441\u0438\u0442\u044c \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u043b\u043e\u0433\u0438 | ProHoster","og:description":"\u0420\u0430\u0437\u0431\u0435\u0440\u0451\u043c \u043e\u0441\u043d\u043e\u0432\u044b \u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 Docker \u0438 Kubernetes, \u0430 \u0437\u0430\u0442\u0435\u043c \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0434\u0432\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0441\u043c\u0435\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u0440\u043e\u0434\u0430\u043a\u0448\u0435\u043d\u0435: Grafana Loki \u0438 \u0441\u0442\u0435\u043a EFK (Elasticsearch + Fluent Bit + Kibana)..","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/logirovanie-v-kubernetes-kak-sobirat-hranit-parsit-i-obrabatyvat-logi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-05T05:42:58+00:00","article:modified_time":"2020-09-05T05:42:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93294","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:50:29","updated":"2022-09-27 18:43:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/93294","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=93294"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/93294\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/93295"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=93294"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=93294"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=93294"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}