由于java的错误日志是多行的，默认filebeat取日志是单行的，像如果有错误了就只能显示一行，像at下面的多行错误日志就不成了，看了网上好多网站上说的都不太清楚，在此我补充一下，让大家更好的知道怎么配置才对，下面我是把confiigmap等相关都写在一个配置文件里了。如下：

1、制做一个tomcat镜像， 这里就不说了，或者在网上随便找一个就成，

2、制做filebeat镜像，我是参考网上做的，稍加改动下，符合自己公司的，也是更改起来方便些，下面是Dockerfile

FROM  docker.io/centos WORKDIR /usr/local ENV FILEBEAT_VERSION=5.4.3 COPY ./filebeat-5.4.3 /usr/local/filebeat-${FILEBEAT_VERSION} RUN set -x
      && ln -s /usr/local/filebeat-${FILEBEAT_VERSION} /usr/local/filebeat
      && chmod +x /usr/local/filebeat/filebeat  
      && mkdir -p /etc/filebeat

ADD ./docker-entrypoint.sh /usr/bin/ RUN chmod +x /usr/bin/docker-entrypoint.sh

ENTRYPOINT ["docker-entrypoint.sh"]

CMD ["/usr/local/filebeat/filebeat","-e","-c","/etc/filebeat/filebeat.yml"]

docker-entrypoint.sh脚本内容如下，需要放在跟Dockerfile同一个目录

#!/bin/bash config=/etc/filebeat/filebeat.yml env echo 'Filebeat init process done. Ready for start up.' echo "Using the following configuration:" cat /etc/filebeat/filebeat.yml exec "$@"

执行build即可。

3、下面是k8s的yaml配置文件如下：

apiVersion: v1 kind: ServiceAccount metadata:   name: filebeat   namespace: default   labels:     app: filebeat

apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRole metadata:   name: filebeat   namespace: default   labels:     app: filebeat rules:

  • apiGroups: [""]   resources:   - namespaces   - pods   verbs:   - get   - watch   - list

apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRoleBinding metadata:   name: filebeat   namespace: default subjects:

  • kind: ServiceAccount   name: filebeat   namespace: default roleRef:   kind: ClusterRole   name: filebeat   apiGroup: rbac.authorization.k8s.io

apiVersion: v1 kind: ConfigMap metadata:   name: filebeat-config data:   filebeat.yml: |     #filebeat.inputs:     filebeat.prospectors:     - type: log       enabled: true       paths:         - "/logs/catalina.*"    #这里就是需要你要收集哪个日志了，也可以是/logs/这样写       multiline.pattern: '^[[:space:]]+(at|.{3})\b|^Caused by:'     #这个就是匹配到错误日志时候把多行的记录为一行       multiline.negate: false       multiline.match: after     output.elasticsearch:       hosts: ["192.103.84.81:9200"]       index: "filebeat_tomcat"     setup.template.name: "filebeattomcat"     setup.template.pattern: "filebeattomcat-"

apiVersion: apps/v1 kind: Deployment metadata:   name: filebeat-tomcat-deploy   namespace: default spec:   replicas: 1   selector:     matchLabels:         app: filebeat-tomcat-deploy   template:     metadata:       annotations:         prometheus.io/scrape: "true"         prometheus.io/port: "9090"       labels:         app: filebeat-tomcat-deploy     spec:       affinity:         nodeAffinity:           requiredDuringSchedulingIgnoredDuringExecution:             nodeSelectorTerms:             - matchExpressions:               - key: beta.kubernetes.io/arch                 operator: In                 values:                 - amd64        # 指定使用的secret       #imagePullSecrets:       #  - name: registry-harbor       containers:       - image: filebeat:v2          imagePullPolicy: IfNotPresent          name: filebeat         volumeMounts:         - name: app-logs           mountPath: /logs         - name: filebeat-config           mountPath: /etc/filebeat/

      - name: tomcat-deploy         image: wuli-tomcat-prometheus:latest         # 只有镜像存在时，才拉取         imagePullPolicy: IfNotPresent         ports:         - containerPort: 8080         - containerPort: 9090         volumeMounts:         - name: app-logs           mountPath: /usr/local/tomcat/logs       volumes:       - name: app-logs         emptyDir: {}       - name: filebeat-config         configMap:           name: filebeat-config

apiVersion: v1 kind: Service metadata:   name: filebeat-tomcat-deploy   labels:     app: filebeat-tomcat-deploy  spec:   type: NodePort   ports:   - port: 80     protocol: TCP     targetPort: 8080   selector:     app: filebeat-tomcat-deploy

	更多k8s相关知识，请移步到https://www.wangshuying.cn