Hey folks Anyone got filebeat working with collecting pod lo rancher-users #rke2

Title

hallowed-breakfast-56871

05/08/2022, 11:12 PM

Hey folks - Anyone got filebeat working with collecting pod logs with RKE2? I see logs are placed / setup differently on RKE2 so this means filebeat gets confused with this logs belongs to which pod. https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html

creamy-pencil-82913

05/08/2022, 11:15 PM

The pod logs should all be in the normal place that the kubelet puts them... /var/log/pods and /var/log/containers ?

hallowed-breakfast-56871

05/08/2022, 11:16 PM

Yes, the issue is the naming conventions and extra subfolders used I think

for example

/var/log/pods/mysql_mysql-7885d65449-w45jv_c4fd04a8-6cde-4245-8f92-ced215521c48/mysql/0.log

Its not using the container ID, so I think filebeat gets confused.

I can of course change the pathings, and that does work, but then the logs are not correctly associated with the pod the generated them... as there is no ID to match to.

/var/log/containers

is just symlinks on a RKE2 server

creamy-pencil-82913

05/08/2022, 11:36 PM

That's the standard location for the kubelet as far as I know, it's not custom to k3s or rke2 but it may be different than when the kubelet uses the legacy dockershim?

4 Views

#rke2 Join Slack