The aggregated logging framework (Logging Architecture), uses Filebeat to send logs from each pod to the ELK stack where they are processed and stored. This requires each pod to have an additional container which will run Filebeat, and for the necessary log files to be accessible between containers.
A reference log demon node project exists that can be used as a guideline for the suggested setup in OOM:
For the setup, we will add two resource files:
- filebeat.yml. This is the filebeat configuration file which determines the path to find log files and any other configuration of Filebeat
- logback.xml. This is the specification of the log format and location.
The deployment in OOM is done via Helm.
Add filebeat.yml to resources (e.g. oom/kubernetes/<component>/resources/config/log/filebeat/filebeat.yml)
A sample filebeat.yml can be found in the log demon node project:
https://gerrit.onap.org/r/gitweb?p=logging-analytics.git;a=tree;f=reference/logging-kubernetes/logdemonode/charts/logdemonode/resources/config/log/filebeat;h=abf4f0a84ae7a15ed99fc4776727e4333948b583;hb=d882270162d56c55da339af8fb9384e1bdc0160dAdd Filebeat container to deployment.yaml:
# Filebeat sidecar container - name: {{ include "common.name" . }}-filebeat-onap image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}" imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} volumeMounts: - name: {{ include "common.fullname" . }}-filebeat-conf mountPath: /usr/share/filebeat/filebeat.yml subPath: filebeat.yml - name: {{ include "common.fullname" . }}-data-filebeat mountPath: /usr/share/filebeat/data - name: {{ include "common.fullname" . }}-logs mountPath: /var/log/onap
Here the image and pull policy and based on global values.
The {{ include "common.fullname" . }}-filebeat-conf volume mount is used to share the filebeat.yml config resource.The {{ include "common.fullname" . }}-logs volume mount is used to share the application logs for other containers in the pod
The {{ include "common.fullname" . }}-data-filebeat volume mount is used to share filebeat logs