使用kubernetes-event-exporter將k8s的事件導出到elasticsearch日志系統中

前提

	版本
kubernetes	v1.17.9
kubernetes-event-exporter	v0.9
elasticsearch	7.3.0

部署

github地址：https://github.com/opsgenie/kubernetes-event-exporter

1. git 克隆鏡像倉庫

# git clone https://github.com/opsgenie/kubernetes-event-exporter.git
Cloning into 'kubernetes-event-exporter'...
remote: Enumerating objects: 518, done.
remote: Counting objects: 100% (518/518), done.
remote: Compressing objects: 100% (426/426), done.
remote: Total 5759 (delta 56), reused 466 (delta 36), pack-reused 5241
Receiving objects: 100% (5759/5759), 7.65 MiB | 4.25 MiB/s, done.
Resolving deltas: 100% (2282/2282), done.

2. 配置01-config.yaml

進到deploy目錄，可以看到這三個yaml文件

# cd kubernetes-event-exporter/deploy/
# ls
00-roles.yaml  01-config.yaml  02-deployment.yaml

其中00-roles.yaml是設置rbac權限

# cat 00-roles.yaml 
apiVersion: v1
kind: Namespace
metadata:
  name: monitoring
---
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: monitoring
  name: event-exporter
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: event-exporter
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
  - kind: ServiceAccount
    namespace: monitoring
    name: event-exporter

01-config.yaml，配置接收者，默認是輸出到本地路徑

# cat 01-config.yaml 
apiVersion: v1
kind: ConfigMap
metadata:
  name: event-exporter-cfg
  namespace: monitoring
data:
  config.yaml: |
    logLevel: error
    logFormat: json
    route:
      routes:
        - match:
            - receiver: "dump"
    receivers:
      - name: "dump"
        file:
          path: "/dev/stdout"

02-deployment.yaml，具體部署的pod應用

# cat 02-deployment.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: event-exporter
  namespace: monitoring
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: event-exporter
        version: v1
    spec:
      serviceAccountName: event-exporter
      containers:
        - name: event-exporter
          image: opsgenie/kubernetes-event-exporter:0.9
          imagePullPolicy: IfNotPresent
          args:
            - -conf=/data/config.yaml
          volumeMounts:
            - mountPath: /data
              name: cfg
      volumes:
        - name: cfg
          configMap:
            name: event-exporter-cfg
  selector:
    matchLabels:
      app: event-exporter
      version: v1

這里有三個yaml，這里我們需要修改01-config.yaml，設置接收者為elasticsearch

# cat 01-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: event-exporter-cfg
  namespace: monitoring
data:
  config.yaml: |
    logLevel: error
    logFormat: json
    route:
      routes:
        - match:
            - receiver: "dump"															# 與下面的name對應
    receivers:
      - name: "dump"
        elasticsearch:																			# 設置接收者為es
          hosts:
          - http://10.43.62.184:9200												# es地址
          index: kube-events																
          indexFormat: "kube-events-{2020-09-08}"						# 索引格式
          useEventID: true

如果是es設置了tls，請參考官方文檔設置相關tls參數：https://github.com/opsgenie/kubernetes-event-exporter#elasticsearch

3. 啟動event-exporter

依次執行這三個文件

kubectl apply -f 00-roles.yaml 
kubectl apply -f 01-config.yaml 
kubectl apply -f 02-deployment.yaml 

4. 查看pod狀態

# kubectl -n monitoring get pod
NAME                              READY   STATUS    RESTARTS   AGE
event-exporter-7cfbbcff69-xxg9t   1/1     Running   0          48m

5. 查看elasticsearch

# curl http://10.43.62.184:9200/_cat/indices?v
health status index                  uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .kibana_task_manager   Qb6qPAipQZiAb29B8VCJ3Q   1   1          2            0     59.2kb         29.6kb
green  open   kube-events-2020-09-08 gbrvIqevRAGGjxIbR993mA   1   1         16            0      129kb         56.2kb
green  open   .kibana_1              mVv0LHetQ1mcGbYnbaF3Fg   1   1          4            0     64.2kb         32.1kb

對接成功