[{"data":1,"prerenderedAt":5391},["ShallowReactive",2],{"content:\u002F2026\u002F07\u002Fk8s-logs-to-elk-with-fluent-bit":3,"surround:\u002F2026\u002F07\u002Fk8s-logs-to-elk-with-fluent-bit":5380},{"id":4,"title":5,"body":6,"categories":5337,"date":5339,"description":5340,"draft":5341,"extension":5342,"image":5343,"meta":5344,"navigation":520,"path":5346,"permalink":5343,"published":5343,"readingTime":5347,"recommend":5343,"references":5352,"seo":5369,"sitemap":5370,"stem":5371,"tags":5372,"type":5378,"updated":5339,"__hash__":5379},"content\u002Fposts\u002F2026\u002F07\u002Fk8s-logs-to-elk-with-fluent-bit.md","使用 Fluent Bit 将 Kubernetes 日志采集到 ELK",{"type":7,"value":8,"toc":5306},"minimark",[9,18,21,27,31,41,44,47,74,78,81,107,110,113,119,126,178,183,190,554,565,591,594,635,642,668,672,675,696,702,720,727,734,750,757,760,860,863,937,940,972,975,979,987,991,996,1214,1223,1242,1252,1255,1288,1291,1347,1360,1369,1388,1391,1395,1398,1461,1464,1468,1471,1502,1508,4414,4417,4486,4489,4493,4496,4520,4525,4528,4531,4582,4585,4607,4610,4695,4703,4709,4716,4744,4747,4765,4768,4772,4779,4783,4794,4798,4809,4812,4866,4873,4877,4883,4886,4890,4893,4929,4940,4944,4947,5005,5016,5020,5023,5059,5062,5082,5086,5093,5097,5100,5122,5170,5174,5181,5184,5187,5213,5216,5219,5302],[10,11,12,13,17],"p",{},"应用运行在 Kubernetes 以后，日志分散在不同节点和 Pod 中。只靠 ",[14,15,16],"code",{"code":16},"kubectl logs"," 临时查询没有问题，但遇到跨 Pod 检索、历史追踪或线上事故复盘时就会比较吃力。",[10,19,20],{},"本文搭建一条轻量的 ELK 日志链路：Elasticsearch 和 Kibana 部署在一台日志服务器上，Fluent Bit 以 DaemonSet 运行在 Kubernetes 的每个节点，读取容器标准输出并写入 Elasticsearch。",[22,23,24],"blockquote",{},[10,25,26],{},"本文所有密码、IP、目录和业务名称均为示例。不要把真实密码直接提交到 Git 仓库，也不要照搬示例密码到生产环境。",[28,29,30],"h2",{"id":30},"整体架构",[32,33,39],"pre",{"className":34,"code":36,"language":37,"meta":38},[35],"language-text","应用 stdout \u002F stderr\n │\n ▼\n\u002Fvar\u002Flog\u002Fcontainers\u002F*.log（每个 K8s 节点）\n │\n ▼\nFluent Bit DaemonSet\n 1. tail 持续读取文件\n 2. kubernetes filter 补充 namespace、pod、container 等元数据\n 3. 本地磁盘缓冲，避免 ES 短暂不可用时立即丢日志\n │\n ▼\nElasticsearch 8.x ──────► Kibana 8.x\n","text","",[14,40,36],{"__ignoreMap":38},[10,42,43],{},"这里没有单独部署 Logstash。当前场景只是采集容器日志、补充 Kubernetes 元数据并写入 Elasticsearch，Fluent Bit 已经能够完成这些工作。只有在需要复杂的数据清洗、跨数据源编排或大量条件路由时，才有必要再引入 Logstash。",[28,45,46],{"id":46},"前置条件",[48,49,50,58,61,68,71],"ul",{},[51,52,53,54,57],"li",{},"Kubernetes 节点使用常见的 Docker 或 CRI 日志格式，日志可从 ",[14,55,56],{"code":56},"\u002Fvar\u002Flog\u002Fcontainers"," 读取。",[51,59,60],{},"日志服务器已经安装 Docker 与 Docker Compose。",[51,62,63,64,67],{},"Kubernetes 节点能访问 Elasticsearch 的 ",[14,65,66],{"code":66},"9200"," 端口。",[51,69,70],{},"Elasticsearch 与 Kibana 使用相同的 8.x 小版本，避免兼容性问题。",[51,72,73],{},"生产环境应使用 HTTPS、网络访问控制和独立的最小权限用户；本文为便于展示，内网示例关闭了 HTTP TLS。",[28,75,77],{"id":76},"分开部署-elasticsearch-与-kibana","分开部署 Elasticsearch 与 Kibana",[10,79,80],{},"先创建一个外部 Docker 网络，让两个 Compose 服务可以通过容器名互相访问：",[32,82,86],{"className":83,"code":84,"language":85,"meta":38,"style":38},"language-bash shiki shiki-themes github-light github-dark","docker network create app-network\n","bash",[14,87,88],{"__ignoreMap":38},[89,90,93,97,101,104],"span",{"class":91,"data-line":92,"line":92},"line",1,[89,94,96],{"class":95},"sScJk","docker",[89,98,100],{"class":99},"sZZnC"," network",[89,102,103],{"class":99}," create",[89,105,106],{"class":99}," app-network\n",[10,108,109],{},"Elasticsearch 和 Kibana 使用两个独立目录、两份 Compose 文件。这样可以分别启动、停止和升级，不会因为修改其中一个服务而影响另一个服务。",[10,111,112],{},"目录结构如下：",[32,114,117],{"className":115,"code":116,"language":37,"meta":38},[35],"\u002Fapp\u002F\n├── elasticsearch\u002F\n│ ├── docker-compose.yml\n│ ├── .env\n│ ├── data\u002F\n│ └── backup\u002F\n└── kibana\u002F\n ├── docker-compose.yml\n ├── .env\n ├── data\u002F\n └── plugins\u002F\n",[14,118,116],{"__ignoreMap":38},[10,120,121,122,125],{},"Elasticsearch 容器默认以 UID ",[14,123,124],{"code":124},"1000"," 运行。绑定宿主机目录前要给予写权限：",[32,127,129],{"className":83,"code":128,"language":85,"meta":38,"style":38},"sudo mkdir -p \u002Fapp\u002Felasticsearch\u002F{data,backup}\nsudo mkdir -p \u002Fapp\u002Fkibana\u002F{data,plugins}\nsudo chown -R 1000:1000 \u002Fapp\u002Felasticsearch \u002Fapp\u002Fkibana\n",[14,130,131,146,158],{"__ignoreMap":38},[89,132,133,136,139,143],{"class":91,"data-line":92,"line":92},[89,134,135],{"class":95},"sudo",[89,137,138],{"class":99}," mkdir",[89,140,142],{"class":141},"sj4cs"," -p",[89,144,145],{"class":99}," \u002Fapp\u002Felasticsearch\u002F{data,backup}\n",[89,147,149,151,153,155],{"class":91,"data-line":148,"line":148},2,[89,150,135],{"class":95},[89,152,138],{"class":99},[89,154,142],{"class":141},[89,156,157],{"class":99}," \u002Fapp\u002Fkibana\u002F{data,plugins}\n",[89,159,161,163,166,169,172,175],{"class":91,"data-line":160,"line":160},3,[89,162,135],{"class":95},[89,164,165],{"class":99}," chown",[89,167,168],{"class":141}," -R",[89,170,171],{"class":99}," 1000:1000",[89,173,174],{"class":99}," \u002Fapp\u002Felasticsearch",[89,176,177],{"class":99}," \u002Fapp\u002Fkibana\n",[179,180,182],"h3",{"id":181},"单独部署-elasticsearch","单独部署 Elasticsearch",[10,184,185,186,189],{},"把下面内容保存为 ",[14,187,188],{"code":188},"\u002Fapp\u002Felasticsearch\u002Fdocker-compose.yml","：",[32,191,195],{"className":192,"code":193,"language":194,"meta":38,"style":38},"language-yaml shiki shiki-themes github-light github-dark","services:\n elasticsearch:\n image: docker.elastic.co\u002Felasticsearch\u002Felasticsearch:8.19.10\n container_name: elasticsearch\n restart: unless-stopped\n environment:\n - discovery.type=single-node\n - bootstrap.memory_lock=true\n - ES_JAVA_OPTS=-Xms1g -Xmx1g\n - xpack.security.enabled=true\n - xpack.security.http.ssl.enabled=false\n - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}\n ulimits:\n memlock:\n soft: -1\n hard: -1\n ports:\n - \"9200:9200\"\n volumes:\n - .\u002Fdata:\u002Fusr\u002Fshare\u002Felasticsearch\u002Fdata\n - .\u002Fbackup:\u002Fusr\u002Fshare\u002Felasticsearch\u002Fbackup\n networks:\n - app-network\n\nnetworks:\n app-network:\n external: true\n","yaml",[14,196,197,207,218,233,248,263,275,290,304,318,332,346,360,372,386,405,423,435,449,461,475,489,501,515,522,529,539],{"__ignoreMap":38},[89,198,199,203],{"class":91,"data-line":92,"line":92},[89,200,202],{"class":201},"s9eBZ","services",[89,204,206],{"class":205},"sVt8B",":\n",[89,208,209,213,216],{"class":91,"data-line":148,"line":148},[89,210,212],{"class":211},"indent"," ",[89,214,215],{"class":201},"elasticsearch",[89,217,206],{"class":205},[89,219,220,222,224,227,230],{"class":91,"data-line":160,"line":160},[89,221,212],{"class":211},[89,223,212],{"class":211},[89,225,226],{"class":201},"image",[89,228,229],{"class":205},": ",[89,231,232],{"class":99},"docker.elastic.co\u002Felasticsearch\u002Felasticsearch:8.19.10\n",[89,234,236,238,240,243,245],{"class":91,"data-line":235,"line":235},4,[89,237,212],{"class":211},[89,239,212],{"class":211},[89,241,242],{"class":201},"container_name",[89,244,229],{"class":205},[89,246,247],{"class":99},"elasticsearch\n",[89,249,251,253,255,258,260],{"class":91,"data-line":250,"line":250},5,[89,252,212],{"class":211},[89,254,212],{"class":211},[89,256,257],{"class":201},"restart",[89,259,229],{"class":205},[89,261,262],{"class":99},"unless-stopped\n",[89,264,266,268,270,273],{"class":91,"data-line":265,"line":265},6,[89,267,212],{"class":211},[89,269,212],{"class":211},[89,271,272],{"class":201},"environment",[89,274,206],{"class":205},[89,276,278,280,282,284,287],{"class":91,"data-line":277,"line":277},7,[89,279,212],{"class":211},[89,281,212],{"class":211},[89,283,212],{"class":211},[89,285,286],{"class":205},"- ",[89,288,289],{"class":99},"discovery.type=single-node\n",[89,291,293,295,297,299,301],{"class":91,"data-line":292,"line":292},8,[89,294,212],{"class":211},[89,296,212],{"class":211},[89,298,212],{"class":211},[89,300,286],{"class":205},[89,302,303],{"class":99},"bootstrap.memory_lock=true\n",[89,305,307,309,311,313,315],{"class":91,"data-line":306,"line":306},9,[89,308,212],{"class":211},[89,310,212],{"class":211},[89,312,212],{"class":211},[89,314,286],{"class":205},[89,316,317],{"class":99},"ES_JAVA_OPTS=-Xms1g -Xmx1g\n",[89,319,321,323,325,327,329],{"class":91,"data-line":320,"line":320},10,[89,322,212],{"class":211},[89,324,212],{"class":211},[89,326,212],{"class":211},[89,328,286],{"class":205},[89,330,331],{"class":99},"xpack.security.enabled=true\n",[89,333,335,337,339,341,343],{"class":91,"data-line":334,"line":334},11,[89,336,212],{"class":211},[89,338,212],{"class":211},[89,340,212],{"class":211},[89,342,286],{"class":205},[89,344,345],{"class":99},"xpack.security.http.ssl.enabled=false\n",[89,347,349,351,353,355,357],{"class":91,"data-line":348,"line":348},12,[89,350,212],{"class":211},[89,352,212],{"class":211},[89,354,212],{"class":211},[89,356,286],{"class":205},[89,358,359],{"class":99},"ELASTIC_PASSWORD=${ELASTIC_PASSWORD}\n",[89,361,363,365,367,370],{"class":91,"data-line":362,"line":362},13,[89,364,212],{"class":211},[89,366,212],{"class":211},[89,368,369],{"class":201},"ulimits",[89,371,206],{"class":205},[89,373,375,377,379,381,384],{"class":91,"data-line":374,"line":374},14,[89,376,212],{"class":211},[89,378,212],{"class":211},[89,380,212],{"class":211},[89,382,383],{"class":201},"memlock",[89,385,206],{"class":205},[89,387,389,391,393,395,397,400,402],{"class":91,"data-line":388,"line":388},15,[89,390,212],{"class":211},[89,392,212],{"class":211},[89,394,212],{"class":211},[89,396,212],{"class":211},[89,398,399],{"class":201},"soft",[89,401,229],{"class":205},[89,403,404],{"class":141},"-1\n",[89,406,408,410,412,414,416,419,421],{"class":91,"data-line":407,"line":407},16,[89,409,212],{"class":211},[89,411,212],{"class":211},[89,413,212],{"class":211},[89,415,212],{"class":211},[89,417,418],{"class":201},"hard",[89,420,229],{"class":205},[89,422,404],{"class":141},[89,424,426,428,430,433],{"class":91,"data-line":425,"line":425},17,[89,427,212],{"class":211},[89,429,212],{"class":211},[89,431,432],{"class":201},"ports",[89,434,206],{"class":205},[89,436,438,440,442,444,446],{"class":91,"data-line":437,"line":437},18,[89,439,212],{"class":211},[89,441,212],{"class":211},[89,443,212],{"class":211},[89,445,286],{"class":205},[89,447,448],{"class":99},"\"9200:9200\"\n",[89,450,452,454,456,459],{"class":91,"data-line":451,"line":451},19,[89,453,212],{"class":211},[89,455,212],{"class":211},[89,457,458],{"class":201},"volumes",[89,460,206],{"class":205},[89,462,464,466,468,470,472],{"class":91,"data-line":463,"line":463},20,[89,465,212],{"class":211},[89,467,212],{"class":211},[89,469,212],{"class":211},[89,471,286],{"class":205},[89,473,474],{"class":99},".\u002Fdata:\u002Fusr\u002Fshare\u002Felasticsearch\u002Fdata\n",[89,476,478,480,482,484,486],{"class":91,"data-line":477,"line":477},21,[89,479,212],{"class":211},[89,481,212],{"class":211},[89,483,212],{"class":211},[89,485,286],{"class":205},[89,487,488],{"class":99},".\u002Fbackup:\u002Fusr\u002Fshare\u002Felasticsearch\u002Fbackup\n",[89,490,492,494,496,499],{"class":91,"data-line":491,"line":491},22,[89,493,212],{"class":211},[89,495,212],{"class":211},[89,497,498],{"class":201},"networks",[89,500,206],{"class":205},[89,502,504,506,508,510,512],{"class":91,"data-line":503,"line":503},23,[89,505,212],{"class":211},[89,507,212],{"class":211},[89,509,212],{"class":211},[89,511,286],{"class":205},[89,513,514],{"class":99},"app-network\n",[89,516,518],{"class":91,"data-line":517,"line":517},24,[89,519,521],{"emptyLinePlaceholder":520},true,"\n",[89,523,525,527],{"class":91,"data-line":524,"line":524},25,[89,526,498],{"class":201},[89,528,206],{"class":205},[89,530,532,534,537],{"class":91,"data-line":531,"line":531},26,[89,533,212],{"class":211},[89,535,536],{"class":201},"app-network",[89,538,206],{"class":205},[89,540,542,544,546,549,551],{"class":91,"data-line":541,"line":541},27,[89,543,212],{"class":211},[89,545,212],{"class":211},[89,547,548],{"class":201},"external",[89,550,229],{"class":205},[89,552,553],{"class":141},"true\n",[10,555,556,557,560,561,564],{},"在 ",[14,558,559],{"code":559},"\u002Fapp\u002Felasticsearch\u002F.env"," 中设置 ",[14,562,563],{"code":563},"elastic"," 的初始管理员密码：",[32,566,570],{"className":567,"code":568,"language":569,"meta":38,"style":38},"language-dotenv shiki shiki-themes github-light github-dark","ELASTIC_PASSWORD=\u003CELASTIC_INITIAL_ADMIN_PASSWORD>\n","dotenv",[14,571,572],{"__ignoreMap":38},[89,573,574,578,582,585,588],{"class":91,"data-line":92,"line":92},[89,575,577],{"class":576},"s4XuR","ELASTIC_PASSWORD",[89,579,581],{"class":580},"szBVR","=",[89,583,584],{"class":205},"\u003C",[89,586,587],{"class":205},"ELASTIC_INITIAL_ADMIN_PASSWORD",[89,589,590],{"class":205},">\n",[10,592,593],{},"启动 Elasticsearch：",[32,595,597],{"className":83,"code":596,"language":85,"meta":38,"style":38},"cd \u002Fapp\u002Felasticsearch\ndocker compose up -d\ndocker compose logs -f --tail=100\n",[14,598,599,607,620],{"__ignoreMap":38},[89,600,601,604],{"class":91,"data-line":92,"line":92},[89,602,603],{"class":141},"cd",[89,605,606],{"class":99}," \u002Fapp\u002Felasticsearch\n",[89,608,609,611,614,617],{"class":91,"data-line":148,"line":148},[89,610,96],{"class":95},[89,612,613],{"class":99}," compose",[89,615,616],{"class":99}," up",[89,618,619],{"class":141}," -d\n",[89,621,622,624,626,629,632],{"class":91,"data-line":160,"line":160},[89,623,96],{"class":95},[89,625,613],{"class":99},[89,627,628],{"class":99}," logs",[89,630,631],{"class":141}," -f",[89,633,634],{"class":141}," --tail=100\n",[10,636,637,638,641],{},"看到节点启动完成后，按 ",[14,639,640],{"code":640},"Ctrl+C"," 退出日志跟踪，再验证服务：",[32,643,645],{"className":83,"code":644,"language":85,"meta":38,"style":38},"curl -u 'elastic:\u003CELASTIC_INITIAL_ADMIN_PASSWORD>' \\\n http:\u002F\u002F127.0.0.1:9200\u002F_cluster\u002Fhealth?pretty\n",[14,646,647,661],{"__ignoreMap":38},[89,648,649,652,655,658],{"class":91,"data-line":92,"line":92},[89,650,651],{"class":95},"curl",[89,653,654],{"class":141}," -u",[89,656,657],{"class":99}," 'elastic:\u003CELASTIC_INITIAL_ADMIN_PASSWORD>'",[89,659,660],{"class":141}," \\\n",[89,662,663,665],{"class":91,"data-line":148,"line":148},[89,664,212],{"class":211},[89,666,667],{"class":99},"http:\u002F\u002F127.0.0.1:9200\u002F_cluster\u002Fhealth?pretty\n",[179,669,671],{"id":670},"进入-elasticsearch-容器创建用户和密码","进入 Elasticsearch 容器创建用户和密码",[10,673,674],{},"进入 Elasticsearch 容器：",[32,676,678],{"className":83,"code":677,"language":85,"meta":38,"style":38},"docker exec -it elasticsearch bash\n",[14,679,680],{"__ignoreMap":38},[89,681,682,684,687,690,693],{"class":91,"data-line":92,"line":92},[89,683,96],{"class":95},[89,685,686],{"class":99}," exec",[89,688,689],{"class":141}," -it",[89,691,692],{"class":99}," elasticsearch",[89,694,695],{"class":99}," bash\n",[10,697,698,699,701],{},"先设置 ",[14,700,563],{"code":563}," 管理员的新密码：",[32,703,705],{"className":83,"code":704,"language":85,"meta":38,"style":38},"bin\u002Felasticsearch-reset-password -u elastic -i\n",[14,706,707],{"__ignoreMap":38},[89,708,709,712,714,717],{"class":91,"data-line":92,"line":92},[89,710,711],{"class":95},"bin\u002Felasticsearch-reset-password",[89,713,654],{"class":141},[89,715,716],{"class":99}," elastic",[89,718,719],{"class":141}," -i\n",[10,721,722,723,726],{},"命令提示输入密码时，填写新的随机强密码。后面的 ",[14,724,725],{"code":725},"\u003CELASTIC_ADMIN_PASSWORD>"," 均指这个新密码。",[10,728,729,730,733],{},"然后设置 Kibana 后台服务用户 ",[14,731,732],{"code":732},"kibana_system"," 的密码：",[32,735,737],{"className":83,"code":736,"language":85,"meta":38,"style":38},"bin\u002Felasticsearch-reset-password -u kibana_system -i\n",[14,738,739],{"__ignoreMap":38},[89,740,741,743,745,748],{"class":91,"data-line":92,"line":92},[89,742,711],{"class":95},[89,744,654],{"class":141},[89,746,747],{"class":99}," kibana_system",[89,749,719],{"class":141},[10,751,752,753,756],{},"这里设置的密码稍后要写入 Kibana 的 ",[14,754,755],{"code":755},".env","，但不能把它用作 Kibana 网页登录密码。",[10,758,759],{},"接着仍在 Elasticsearch 容器内，通过安全 API 创建 Fluent Bit 的最小权限角色：",[32,761,763],{"className":83,"code":762,"language":85,"meta":38,"style":38},"curl -u 'elastic:\u003CELASTIC_ADMIN_PASSWORD>' \\\n -H 'Content-Type: application\u002Fjson' \\\n -X PUT 'http:\u002F\u002F127.0.0.1:9200\u002F_security\u002Frole\u002Ffluent_bit_writer' \\\n -d '{\n \"cluster\": [\"monitor\"],\n \"indices\": [{\n \"names\": [\"k8s-logs*\"],\n \"privileges\": [\"auto_configure\", \"create_doc\", \"create_index\"]\n }]\n }'\n",[14,764,765,776,788,803,813,821,828,837,846,853],{"__ignoreMap":38},[89,766,767,769,771,774],{"class":91,"data-line":92,"line":92},[89,768,651],{"class":95},[89,770,654],{"class":141},[89,772,773],{"class":99}," 'elastic:\u003CELASTIC_ADMIN_PASSWORD>'",[89,775,660],{"class":141},[89,777,778,780,783,786],{"class":91,"data-line":148,"line":148},[89,779,212],{"class":211},[89,781,782],{"class":141},"-H",[89,784,785],{"class":99}," 'Content-Type: application\u002Fjson'",[89,787,660],{"class":141},[89,789,790,792,795,798,801],{"class":91,"data-line":160,"line":160},[89,791,212],{"class":211},[89,793,794],{"class":141},"-X",[89,796,797],{"class":99}," PUT",[89,799,800],{"class":99}," 'http:\u002F\u002F127.0.0.1:9200\u002F_security\u002Frole\u002Ffluent_bit_writer'",[89,802,660],{"class":141},[89,804,805,807,810],{"class":91,"data-line":235,"line":235},[89,806,212],{"class":211},[89,808,809],{"class":141},"-d",[89,811,812],{"class":99}," '{\n",[89,814,815,818],{"class":91,"data-line":250,"line":250},[89,816,817],{"class":211}," ",[89,819,820],{"class":99},"\"cluster\": [\"monitor\"],\n",[89,822,823,825],{"class":91,"data-line":265,"line":265},[89,824,817],{"class":211},[89,826,827],{"class":99},"\"indices\": [{\n",[89,829,830,832,834],{"class":91,"data-line":277,"line":277},[89,831,817],{"class":211},[89,833,212],{"class":211},[89,835,836],{"class":99},"\"names\": [\"k8s-logs*\"],\n",[89,838,839,841,843],{"class":91,"data-line":292,"line":292},[89,840,817],{"class":211},[89,842,212],{"class":211},[89,844,845],{"class":99},"\"privileges\": [\"auto_configure\", \"create_doc\", \"create_index\"]\n",[89,847,848,850],{"class":91,"data-line":306,"line":306},[89,849,817],{"class":211},[89,851,852],{"class":99},"}]\n",[89,854,855,857],{"class":91,"data-line":320,"line":320},[89,856,212],{"class":211},[89,858,859],{"class":99},"}'\n",[10,861,862],{},"再创建 Fluent Bit 写入用户及密码：",[32,864,866],{"className":83,"code":865,"language":85,"meta":38,"style":38},"curl -u 'elastic:\u003CELASTIC_ADMIN_PASSWORD>' \\\n -H 'Content-Type: application\u002Fjson' \\\n -X POST 'http:\u002F\u002F127.0.0.1:9200\u002F_security\u002Fuser\u002Ffluent_bit' \\\n -d '{\n \"password\": \"\u003CFLUENT_BIT_STRONG_PASSWORD>\",\n \"roles\": [\"fluent_bit_writer\"],\n \"full_name\": \"Fluent Bit log writer\"\n }'\n",[14,867,868,878,888,902,910,917,924,931],{"__ignoreMap":38},[89,869,870,872,874,876],{"class":91,"data-line":92,"line":92},[89,871,651],{"class":95},[89,873,654],{"class":141},[89,875,773],{"class":99},[89,877,660],{"class":141},[89,879,880,882,884,886],{"class":91,"data-line":148,"line":148},[89,881,212],{"class":211},[89,883,782],{"class":141},[89,885,785],{"class":99},[89,887,660],{"class":141},[89,889,890,892,894,897,900],{"class":91,"data-line":160,"line":160},[89,891,212],{"class":211},[89,893,794],{"class":141},[89,895,896],{"class":99}," POST",[89,898,899],{"class":99}," 'http:\u002F\u002F127.0.0.1:9200\u002F_security\u002Fuser\u002Ffluent_bit'",[89,901,660],{"class":141},[89,903,904,906,908],{"class":91,"data-line":235,"line":235},[89,905,212],{"class":211},[89,907,809],{"class":141},[89,909,812],{"class":99},[89,911,912,914],{"class":91,"data-line":250,"line":250},[89,913,817],{"class":211},[89,915,916],{"class":99},"\"password\": \"\u003CFLUENT_BIT_STRONG_PASSWORD>\",\n",[89,918,919,921],{"class":91,"data-line":265,"line":265},[89,920,817],{"class":211},[89,922,923],{"class":99},"\"roles\": [\"fluent_bit_writer\"],\n",[89,925,926,928],{"class":91,"data-line":277,"line":277},[89,927,817],{"class":211},[89,929,930],{"class":99},"\"full_name\": \"Fluent Bit log writer\"\n",[89,932,933,935],{"class":91,"data-line":292,"line":292},[89,934,212],{"class":211},[89,936,859],{"class":99},[10,938,939],{},"验证用户是否创建成功，然后退出容器：",[32,941,943],{"className":83,"code":942,"language":85,"meta":38,"style":38},"curl -u 'fluent_bit:\u003CFLUENT_BIT_STRONG_PASSWORD>' \\\n http:\u002F\u002F127.0.0.1:9200\u002F_security\u002F_authenticate?pretty\n\nexit\n",[14,944,945,956,963,967],{"__ignoreMap":38},[89,946,947,949,951,954],{"class":91,"data-line":92,"line":92},[89,948,651],{"class":95},[89,950,654],{"class":141},[89,952,953],{"class":99}," 'fluent_bit:\u003CFLUENT_BIT_STRONG_PASSWORD>'",[89,955,660],{"class":141},[89,957,958,960],{"class":91,"data-line":148,"line":148},[89,959,212],{"class":211},[89,961,962],{"class":99},"http:\u002F\u002F127.0.0.1:9200\u002F_security\u002F_authenticate?pretty\n",[89,964,965],{"class":91,"data-line":160,"line":160},[89,966,521],{"emptyLinePlaceholder":520},[89,968,969],{"class":91,"data-line":235,"line":235},[89,970,971],{"class":141},"exit\n",[10,973,974],{},"如果集群启用了严格的索引模板或数据流，应按实际写入方式调整权限，而不是把采集用户直接设置为超级用户。",[179,976,978],{"id":977},"为什么-kibana-不能使用-elastic-用户","为什么 Kibana 不能使用 elastic 用户",[10,980,981,983,984,986],{},[14,982,563],{"code":563}," 是 Elasticsearch 的内置超级用户，适合管理员登录和初始化操作，不应该作为 Kibana 服务端的长期运行身份。Kibana 后台应使用专门的内置用户 ",[14,985,732],{"code":732},"。",[179,988,990],{"id":989},"单独部署-kibana","单独部署 Kibana",[10,992,185,993,189],{},[14,994,995],{"code":995},"\u002Fapp\u002Fkibana\u002Fdocker-compose.yml",[32,997,999],{"className":192,"code":998,"language":194,"meta":38,"style":38},"services:\n kibana:\n image: docker.elastic.co\u002Fkibana\u002Fkibana:8.19.10\n container_name: kibana\n restart: unless-stopped\n environment:\n - ELASTICSEARCH_HOSTS=http:\u002F\u002Felasticsearch:9200\n - ELASTICSEARCH_USERNAME=kibana_system\n - ELASTICSEARCH_PASSWORD=${KIBANA_SYSTEM_PASSWORD}\n ports:\n - \"5601:5601\"\n volumes:\n - .\u002Fplugins:\u002Fusr\u002Fshare\u002Fkibana\u002Fplugins\n - .\u002Fdata:\u002Fusr\u002Fshare\u002Fkibana\u002Fdata\n networks:\n - app-network\n\nnetworks:\n app-network:\n external: true\n",[14,1000,1001,1007,1016,1029,1042,1054,1064,1077,1090,1103,1113,1126,1136,1149,1162,1172,1184,1188,1194,1202],{"__ignoreMap":38},[89,1002,1003,1005],{"class":91,"data-line":92,"line":92},[89,1004,202],{"class":201},[89,1006,206],{"class":205},[89,1008,1009,1011,1014],{"class":91,"data-line":148,"line":148},[89,1010,212],{"class":211},[89,1012,1013],{"class":201},"kibana",[89,1015,206],{"class":205},[89,1017,1018,1020,1022,1024,1026],{"class":91,"data-line":160,"line":160},[89,1019,212],{"class":211},[89,1021,212],{"class":211},[89,1023,226],{"class":201},[89,1025,229],{"class":205},[89,1027,1028],{"class":99},"docker.elastic.co\u002Fkibana\u002Fkibana:8.19.10\n",[89,1030,1031,1033,1035,1037,1039],{"class":91,"data-line":235,"line":235},[89,1032,212],{"class":211},[89,1034,212],{"class":211},[89,1036,242],{"class":201},[89,1038,229],{"class":205},[89,1040,1041],{"class":99},"kibana\n",[89,1043,1044,1046,1048,1050,1052],{"class":91,"data-line":250,"line":250},[89,1045,212],{"class":211},[89,1047,212],{"class":211},[89,1049,257],{"class":201},[89,1051,229],{"class":205},[89,1053,262],{"class":99},[89,1055,1056,1058,1060,1062],{"class":91,"data-line":265,"line":265},[89,1057,212],{"class":211},[89,1059,212],{"class":211},[89,1061,272],{"class":201},[89,1063,206],{"class":205},[89,1065,1066,1068,1070,1072,1074],{"class":91,"data-line":277,"line":277},[89,1067,212],{"class":211},[89,1069,212],{"class":211},[89,1071,212],{"class":211},[89,1073,286],{"class":205},[89,1075,1076],{"class":99},"ELASTICSEARCH_HOSTS=http:\u002F\u002Felasticsearch:9200\n",[89,1078,1079,1081,1083,1085,1087],{"class":91,"data-line":292,"line":292},[89,1080,212],{"class":211},[89,1082,212],{"class":211},[89,1084,212],{"class":211},[89,1086,286],{"class":205},[89,1088,1089],{"class":99},"ELASTICSEARCH_USERNAME=kibana_system\n",[89,1091,1092,1094,1096,1098,1100],{"class":91,"data-line":306,"line":306},[89,1093,212],{"class":211},[89,1095,212],{"class":211},[89,1097,212],{"class":211},[89,1099,286],{"class":205},[89,1101,1102],{"class":99},"ELASTICSEARCH_PASSWORD=${KIBANA_SYSTEM_PASSWORD}\n",[89,1104,1105,1107,1109,1111],{"class":91,"data-line":320,"line":320},[89,1106,212],{"class":211},[89,1108,212],{"class":211},[89,1110,432],{"class":201},[89,1112,206],{"class":205},[89,1114,1115,1117,1119,1121,1123],{"class":91,"data-line":334,"line":334},[89,1116,212],{"class":211},[89,1118,212],{"class":211},[89,1120,212],{"class":211},[89,1122,286],{"class":205},[89,1124,1125],{"class":99},"\"5601:5601\"\n",[89,1127,1128,1130,1132,1134],{"class":91,"data-line":348,"line":348},[89,1129,212],{"class":211},[89,1131,212],{"class":211},[89,1133,458],{"class":201},[89,1135,206],{"class":205},[89,1137,1138,1140,1142,1144,1146],{"class":91,"data-line":362,"line":362},[89,1139,212],{"class":211},[89,1141,212],{"class":211},[89,1143,212],{"class":211},[89,1145,286],{"class":205},[89,1147,1148],{"class":99},".\u002Fplugins:\u002Fusr\u002Fshare\u002Fkibana\u002Fplugins\n",[89,1150,1151,1153,1155,1157,1159],{"class":91,"data-line":374,"line":374},[89,1152,212],{"class":211},[89,1154,212],{"class":211},[89,1156,212],{"class":211},[89,1158,286],{"class":205},[89,1160,1161],{"class":99},".\u002Fdata:\u002Fusr\u002Fshare\u002Fkibana\u002Fdata\n",[89,1163,1164,1166,1168,1170],{"class":91,"data-line":388,"line":388},[89,1165,212],{"class":211},[89,1167,212],{"class":211},[89,1169,498],{"class":201},[89,1171,206],{"class":205},[89,1173,1174,1176,1178,1180,1182],{"class":91,"data-line":407,"line":407},[89,1175,212],{"class":211},[89,1177,212],{"class":211},[89,1179,212],{"class":211},[89,1181,286],{"class":205},[89,1183,514],{"class":99},[89,1185,1186],{"class":91,"data-line":425,"line":425},[89,1187,521],{"emptyLinePlaceholder":520},[89,1189,1190,1192],{"class":91,"data-line":437,"line":437},[89,1191,498],{"class":201},[89,1193,206],{"class":205},[89,1195,1196,1198,1200],{"class":91,"data-line":451,"line":451},[89,1197,212],{"class":211},[89,1199,536],{"class":201},[89,1201,206],{"class":205},[89,1203,1204,1206,1208,1210,1212],{"class":91,"data-line":463,"line":463},[89,1205,212],{"class":211},[89,1207,212],{"class":211},[89,1209,548],{"class":201},[89,1211,229],{"class":205},[89,1213,553],{"class":141},[10,1215,556,1216,1219,1220,1222],{},[14,1217,1218],{"code":1218},"\u002Fapp\u002Fkibana\u002F.env"," 写入刚才在 Elasticsearch 容器中为 ",[14,1221,732],{"code":732}," 设置的密码：",[32,1224,1226],{"className":567,"code":1225,"language":569,"meta":38,"style":38},"KIBANA_SYSTEM_PASSWORD=\u003CKIBANA_INTERNAL_PASSWORD>\n",[14,1227,1228],{"__ignoreMap":38},[89,1229,1230,1233,1235,1237,1240],{"class":91,"data-line":92,"line":92},[89,1231,1232],{"class":576},"KIBANA_SYSTEM_PASSWORD",[89,1234,581],{"class":580},[89,1236,584],{"class":205},[89,1238,1239],{"class":205},"KIBANA_INTERNAL_PASSWORD",[89,1241,590],{"class":205},[10,1243,1244,1245,1248,1249,1251],{},"分别部署以后，Kibana 的 Compose 文件里不需要 ",[14,1246,1247],{"code":1247},"depends_on","。它通过外部网络 ",[14,1250,536],{"code":536}," 连接已经运行的 Elasticsearch 容器。",[10,1253,1254],{},"启动 Kibana：",[32,1256,1258],{"className":83,"code":1257,"language":85,"meta":38,"style":38},"cd \u002Fapp\u002Fkibana\ndocker compose up -d\ndocker compose logs -f --tail=100\n",[14,1259,1260,1266,1276],{"__ignoreMap":38},[89,1261,1262,1264],{"class":91,"data-line":92,"line":92},[89,1263,603],{"class":141},[89,1265,177],{"class":99},[89,1267,1268,1270,1272,1274],{"class":91,"data-line":148,"line":148},[89,1269,96],{"class":95},[89,1271,613],{"class":99},[89,1273,616],{"class":99},[89,1275,619],{"class":141},[89,1277,1278,1280,1282,1284,1286],{"class":91,"data-line":160,"line":160},[89,1279,96],{"class":95},[89,1281,613],{"class":99},[89,1283,628],{"class":99},[89,1285,631],{"class":141},[89,1287,634],{"class":141},[10,1289,1290],{},"检查两个独立服务的状态：",[32,1292,1294],{"className":83,"code":1293,"language":85,"meta":38,"style":38},"curl -u 'elastic:\u003CELASTIC_ADMIN_PASSWORD>' \\\n http:\u002F\u002F127.0.0.1:9200\u002F_cluster\u002Fhealth?pretty\n\ncd \u002Fapp\u002Felasticsearch && docker compose ps\ncd \u002Fapp\u002Fkibana && docker compose ps\n",[14,1295,1296,1306,1312,1316,1332],{"__ignoreMap":38},[89,1297,1298,1300,1302,1304],{"class":91,"data-line":92,"line":92},[89,1299,651],{"class":95},[89,1301,654],{"class":141},[89,1303,773],{"class":99},[89,1305,660],{"class":141},[89,1307,1308,1310],{"class":91,"data-line":148,"line":148},[89,1309,212],{"class":211},[89,1311,667],{"class":99},[89,1313,1314],{"class":91,"data-line":160,"line":160},[89,1315,521],{"emptyLinePlaceholder":520},[89,1317,1318,1320,1322,1325,1327,1329],{"class":91,"data-line":235,"line":235},[89,1319,603],{"class":141},[89,1321,174],{"class":99},[89,1323,1324],{"class":205}," && ",[89,1326,96],{"class":95},[89,1328,613],{"class":99},[89,1330,1331],{"class":99}," ps\n",[89,1333,1334,1336,1339,1341,1343,1345],{"class":91,"data-line":250,"line":250},[89,1335,603],{"class":141},[89,1337,1338],{"class":99}," \u002Fapp\u002Fkibana",[89,1340,1324],{"class":205},[89,1342,96],{"class":95},[89,1344,613],{"class":99},[89,1346,1331],{"class":99},[10,1348,1349,1350,1353,1354,1356,1357,1359],{},"浏览器访问 ",[14,1351,1352],{"code":1352},"http:\u002F\u002F\u003CELK_SERVER_IP>:5601","，登录时使用 ",[14,1355,563],{"code":563}," 管理员账户，而不是 ",[14,1358,732],{"code":732},"。后者是 Kibana 后台服务账户，不用于网页登录。",[10,1361,1362,1363,1365,1366,189],{},"两个目录中的 ",[14,1364,755],{"code":755}," 都要限制文件权限并加入 ",[14,1367,1368],{"code":1368},".gitignore",[32,1370,1372],{"className":83,"code":1371,"language":85,"meta":38,"style":38},"chmod 600 \u002Fapp\u002Felasticsearch\u002F.env \u002Fapp\u002Fkibana\u002F.env\n",[14,1373,1374],{"__ignoreMap":38},[89,1375,1376,1379,1382,1385],{"class":91,"data-line":92,"line":92},[89,1377,1378],{"class":95},"chmod",[89,1380,1381],{"class":141}," 600",[89,1383,1384],{"class":99}," \u002Fapp\u002Felasticsearch\u002F.env",[89,1386,1387],{"class":99}," \u002Fapp\u002Fkibana\u002F.env\n",[10,1389,1390],{},"更稳妥的方式是使用 Docker Secret 或外部密钥管理服务。",[28,1392,1394],{"id":1393},"创建-kubernetes-secret","创建 Kubernetes Secret",[10,1396,1397],{},"不要把 Elasticsearch 密码直接写进 DaemonSet YAML。使用 Secret 注入连接信息：",[32,1399,1401],{"className":83,"code":1400,"language":85,"meta":38,"style":38},"kubectl -n default create secret generic fluent-bit-es-auth \\\n --from-literal=host='\u003CELK_SERVER_PRIVATE_IP>' \\\n --from-literal=username='fluent_bit' \\\n --from-literal=password='\u003CFLUENT_BIT_STRONG_PASSWORD>'\n",[14,1402,1403,1427,1439,1451],{"__ignoreMap":38},[89,1404,1405,1408,1411,1414,1416,1419,1422,1425],{"class":91,"data-line":92,"line":92},[89,1406,1407],{"class":95},"kubectl",[89,1409,1410],{"class":141}," -n",[89,1412,1413],{"class":99}," default",[89,1415,103],{"class":99},[89,1417,1418],{"class":99}," secret",[89,1420,1421],{"class":99}," generic",[89,1423,1424],{"class":99}," fluent-bit-es-auth",[89,1426,660],{"class":141},[89,1428,1429,1431,1434,1437],{"class":91,"data-line":148,"line":148},[89,1430,212],{"class":211},[89,1432,1433],{"class":141},"--from-literal=host=",[89,1435,1436],{"class":99},"'\u003CELK_SERVER_PRIVATE_IP>'",[89,1438,660],{"class":141},[89,1440,1441,1443,1446,1449],{"class":91,"data-line":160,"line":160},[89,1442,212],{"class":211},[89,1444,1445],{"class":141},"--from-literal=username=",[89,1447,1448],{"class":99},"'fluent_bit'",[89,1450,660],{"class":141},[89,1452,1453,1455,1458],{"class":91,"data-line":235,"line":235},[89,1454,212],{"class":211},[89,1456,1457],{"class":141},"--from-literal=password=",[89,1459,1460],{"class":99},"'\u003CFLUENT_BIT_STRONG_PASSWORD>'\n",[10,1462,1463],{},"命令会把明文留在 Shell 历史中。正式环境可使用 Sealed Secrets、External Secrets 或云厂商 Secret Manager。",[28,1465,1467],{"id":1466},"部署-fluent-bit-daemonset","部署 Fluent Bit DaemonSet",[10,1469,1470],{},"下面的清单在原有配置上做了几项调整：",[48,1472,1473,1480,1490,1493,1496,1499],{},[51,1474,1475,1476,1479],{},"Fluent Bit、ConfigMap 和 Secret 都部署在 ",[14,1477,1478],{"code":1478},"default"," 命名空间。",[51,1481,1482,1483,1486,1487,1489],{},"日志路径只匹配 ",[14,1484,1485],{"code":1485},"_default_","，因此仅采集 ",[14,1488,1478],{"code":1478}," 命名空间中的容器日志。",[51,1491,1492],{},"排除 Fluent Bit 自身日志，避免采集链路形成噪声或循环。",[51,1494,1495],{},"通过 RBAC 读取 Pod 与 Namespace 信息。",[51,1497,1498],{},"启用数据库游标和文件系统缓冲，容器重启后可以尽量接着读取。",[51,1500,1501],{},"使用健康检查和资源限制，便于 Kubernetes 管理采集器。",[10,1503,1504,1505,189],{},"保存为 ",[14,1506,1507],{"code":1507},"fluent-bit.yaml",[32,1509,1511],{"className":192,"code":1510,"language":194,"meta":38,"style":38},"apiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: fluent-bit\n namespace: default\n---\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: ClusterRole\nmetadata:\n name: fluent-bit-read-kubernetes\nrules:\n - apiGroups: [\"\"]\n resources: [\"namespaces\", \"pods\"]\n verbs: [\"get\", \"list\", \"watch\"]\n---\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: ClusterRoleBinding\nmetadata:\n name: fluent-bit-read-kubernetes\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: fluent-bit-read-kubernetes\nsubjects:\n - kind: ServiceAccount\n name: fluent-bit\n namespace: default\n---\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: fluent-bit-config\n namespace: default\ndata:\n fluent-bit.conf: |\n [SERVICE]\n Flush 2\n Grace 30\n Log_Level info\n Daemon off\n Parsers_File parsers.conf\n HTTP_Server on\n HTTP_Listen 0.0.0.0\n HTTP_Port 2020\n storage.path \u002Fvar\u002Flib\u002Ffluent-bit\u002Fstorage\n storage.sync normal\n storage.checksum off\n storage.max_chunks_up 64\n storage.backlog.mem_limit 5M\n\n [INPUT]\n Name tail\n Tag kube.*\n Path \u002Fvar\u002Flog\u002Fcontainers\u002F*_default_*.log\n Exclude_Path \u002Fvar\u002Flog\u002Fcontainers\u002Ffluent-bit-*_default_*.log\n multiline.parser docker, cri\n DB \u002Fvar\u002Flib\u002Ffluent-bit\u002Ftail-containers.db\n DB.Sync Normal\n Mem_Buf_Limit 5MB\n Buffer_Chunk_Size 32KB\n Buffer_Max_Size 256KB\n Skip_Long_Lines on\n Refresh_Interval 10\n Rotate_Wait 30\n storage.type filesystem\n\n [FILTER]\n Name kubernetes\n Match kube.*\n Kube_URL https:\u002F\u002Fkubernetes.default.svc:443\n Kube_CA_File \u002Fvar\u002Frun\u002Fsecrets\u002Fkubernetes.io\u002Fserviceaccount\u002Fca.crt\n Kube_Token_File \u002Fvar\u002Frun\u002Fsecrets\u002Fkubernetes.io\u002Fserviceaccount\u002Ftoken\n Kube_Tag_Prefix kube.var.log.containers.\n Merge_Log on\n Keep_Log off\n K8S-Logging.Parser on\n K8S-Logging.Exclude on\n Labels on\n Annotations off\n\n [OUTPUT]\n Name es\n Match kube.*\n Host ${ES_HOST}\n Port 9200\n HTTP_User ${ES_USER}\n HTTP_Passwd ${ES_PASSWORD}\n Logstash_Format on\n Logstash_Prefix k8s-logs\n Suppress_Type_Name on\n Generate_ID on\n Replace_Dots on\n Workers 1\n Retry_Limit False\n---\napiVersion: apps\u002Fv1\nkind: DaemonSet\nmetadata:\n name: fluent-bit\n namespace: default\n labels:\n app.kubernetes.io\u002Fname: fluent-bit\n app.kubernetes.io\u002Fpart-of: logging\nspec:\n selector:\n matchLabels:\n app.kubernetes.io\u002Fname: fluent-bit\n template:\n metadata:\n labels:\n app.kubernetes.io\u002Fname: fluent-bit\n app.kubernetes.io\u002Fpart-of: logging\n annotations:\n fluentbit.io\u002Fexclude: \"true\"\n spec:\n serviceAccountName: fluent-bit\n terminationGracePeriodSeconds: 30\n tolerations:\n - operator: Exists\n containers:\n - name: fluent-bit\n image: fluent\u002Ffluent-bit:5.0.9\n imagePullPolicy: IfNotPresent\n env:\n - name: ES_HOST\n valueFrom:\n secretKeyRef:\n name: fluent-bit-es-auth\n key: host\n - name: ES_USER\n valueFrom:\n secretKeyRef:\n name: fluent-bit-es-auth\n key: username\n - name: ES_PASSWORD\n valueFrom:\n secretKeyRef:\n name: fluent-bit-es-auth\n key: password\n ports:\n - name: health\n containerPort: 2020\n protocol: TCP\n livenessProbe:\n httpGet:\n path: \u002Fapi\u002Fv1\u002Fuptime\n port: health\n initialDelaySeconds: 10\n periodSeconds: 20\n readinessProbe:\n httpGet:\n path: \u002Fapi\u002Fv1\u002Fuptime\n port: health\n initialDelaySeconds: 5\n periodSeconds: 10\n resources:\n requests:\n cpu: 20m\n memory: 30Mi\n limits:\n cpu: 150m\n memory: 96Mi\n volumeMounts:\n - name: config\n mountPath: \u002Ffluent-bit\u002Fetc\u002Ffluent-bit.conf\n subPath: fluent-bit.conf\n readOnly: true\n - name: varlog\n mountPath: \u002Fvar\u002Flog\n readOnly: true\n - name: state\n mountPath: \u002Fvar\u002Flib\u002Ffluent-bit\n volumes:\n - name: config\n configMap:\n name: fluent-bit-config\n - name: varlog\n hostPath:\n path: \u002Fvar\u002Flog\n type: Directory\n - name: state\n hostPath:\n path: \u002Fvar\u002Flib\u002Ffluent-bit\n type: DirectoryOrCreate\n",[14,1512,1513,1523,1533,1540,1552,1564,1569,1578,1587,1593,1604,1611,1632,1656,1684,1688,1696,1705,1711,1721,1728,1740,1750,1760,1767,1779,1791,1803,1808,1817,1827,1834,1846,1857,1865,1878,1888,1902,1916,1930,1944,1958,1972,1986,2000,2014,2028,2042,2056,2070,2075,2085,2099,2113,2127,2141,2155,2169,2183,2197,2211,2225,2239,2253,2267,2281,2286,2296,2310,2324,2338,2352,2366,2380,2394,2408,2422,2436,2450,2464,2469,2479,2493,2506,2520,2534,2548,2562,2576,2590,2604,2618,2632,2646,2660,2665,2675,2685,2692,2703,2714,2724,2738,2753,2761,2771,2783,2798,2808,2819,2832,2849,2866,2880,2899,2910,2926,2943,2957,2978,2992,3011,3031,3052,3070,3094,3116,3140,3168,3197,3221,3242,3265,3292,3320,3344,3365,3388,3415,3443,3460,3484,3509,3534,3552,3572,3597,3621,3644,3667,3685,3704,3727,3750,3772,3793,3810,3830,3855,3880,3900,3924,3948,3966,3990,4015,4040,4064,4088,4112,4135,4159,4183,4196,4215,4233,4254,4273,4291,4312,4335,4354,4371,4392],{"__ignoreMap":38},[89,1514,1515,1518,1520],{"class":91,"data-line":92,"line":92},[89,1516,1517],{"class":201},"apiVersion",[89,1519,229],{"class":205},[89,1521,1522],{"class":99},"v1\n",[89,1524,1525,1528,1530],{"class":91,"data-line":148,"line":148},[89,1526,1527],{"class":201},"kind",[89,1529,229],{"class":205},[89,1531,1532],{"class":99},"ServiceAccount\n",[89,1534,1535,1538],{"class":91,"data-line":160,"line":160},[89,1536,1537],{"class":201},"metadata",[89,1539,206],{"class":205},[89,1541,1542,1544,1547,1549],{"class":91,"data-line":235,"line":235},[89,1543,212],{"class":211},[89,1545,1546],{"class":201},"name",[89,1548,229],{"class":205},[89,1550,1551],{"class":99},"fluent-bit\n",[89,1553,1554,1556,1559,1561],{"class":91,"data-line":250,"line":250},[89,1555,212],{"class":211},[89,1557,1558],{"class":201},"namespace",[89,1560,229],{"class":205},[89,1562,1563],{"class":99},"default\n",[89,1565,1566],{"class":91,"data-line":265,"line":265},[89,1567,1568],{"class":95},"---\n",[89,1570,1571,1573,1575],{"class":91,"data-line":277,"line":277},[89,1572,1517],{"class":201},[89,1574,229],{"class":205},[89,1576,1577],{"class":99},"rbac.authorization.k8s.io\u002Fv1\n",[89,1579,1580,1582,1584],{"class":91,"data-line":292,"line":292},[89,1581,1527],{"class":201},[89,1583,229],{"class":205},[89,1585,1586],{"class":99},"ClusterRole\n",[89,1588,1589,1591],{"class":91,"data-line":306,"line":306},[89,1590,1537],{"class":201},[89,1592,206],{"class":205},[89,1594,1595,1597,1599,1601],{"class":91,"data-line":320,"line":320},[89,1596,212],{"class":211},[89,1598,1546],{"class":201},[89,1600,229],{"class":205},[89,1602,1603],{"class":99},"fluent-bit-read-kubernetes\n",[89,1605,1606,1609],{"class":91,"data-line":334,"line":334},[89,1607,1608],{"class":201},"rules",[89,1610,206],{"class":205},[89,1612,1613,1615,1617,1620,1622,1626,1629],{"class":91,"data-line":348,"line":348},[89,1614,212],{"class":211},[89,1616,286],{"class":205},[89,1618,1619],{"class":201},"apiGroups",[89,1621,229],{"class":205},[89,1623,1625],{"class":1624},"sSDpw","[",[89,1627,1628],{"class":99},"\"\"",[89,1630,1631],{"class":1624},"]\n",[89,1633,1634,1636,1638,1641,1643,1645,1648,1651,1654],{"class":91,"data-line":362,"line":362},[89,1635,212],{"class":211},[89,1637,212],{"class":211},[89,1639,1640],{"class":201},"resources",[89,1642,229],{"class":205},[89,1644,1625],{"class":1624},[89,1646,1647],{"class":99},"\"namespaces\"",[89,1649,1650],{"class":205},", ",[89,1652,1653],{"class":99},"\"pods\"",[89,1655,1631],{"class":1624},[89,1657,1658,1660,1662,1665,1667,1669,1672,1674,1677,1679,1682],{"class":91,"data-line":374,"line":374},[89,1659,212],{"class":211},[89,1661,212],{"class":211},[89,1663,1664],{"class":201},"verbs",[89,1666,229],{"class":205},[89,1668,1625],{"class":1624},[89,1670,1671],{"class":99},"\"get\"",[89,1673,1650],{"class":205},[89,1675,1676],{"class":99},"\"list\"",[89,1678,1650],{"class":205},[89,1680,1681],{"class":99},"\"watch\"",[89,1683,1631],{"class":1624},[89,1685,1686],{"class":91,"data-line":388,"line":388},[89,1687,1568],{"class":95},[89,1689,1690,1692,1694],{"class":91,"data-line":407,"line":407},[89,1691,1517],{"class":201},[89,1693,229],{"class":205},[89,1695,1577],{"class":99},[89,1697,1698,1700,1702],{"class":91,"data-line":425,"line":425},[89,1699,1527],{"class":201},[89,1701,229],{"class":205},[89,1703,1704],{"class":99},"ClusterRoleBinding\n",[89,1706,1707,1709],{"class":91,"data-line":437,"line":437},[89,1708,1537],{"class":201},[89,1710,206],{"class":205},[89,1712,1713,1715,1717,1719],{"class":91,"data-line":451,"line":451},[89,1714,212],{"class":211},[89,1716,1546],{"class":201},[89,1718,229],{"class":205},[89,1720,1603],{"class":99},[89,1722,1723,1726],{"class":91,"data-line":463,"line":463},[89,1724,1725],{"class":201},"roleRef",[89,1727,206],{"class":205},[89,1729,1730,1732,1735,1737],{"class":91,"data-line":477,"line":477},[89,1731,212],{"class":211},[89,1733,1734],{"class":201},"apiGroup",[89,1736,229],{"class":205},[89,1738,1739],{"class":99},"rbac.authorization.k8s.io\n",[89,1741,1742,1744,1746,1748],{"class":91,"data-line":491,"line":491},[89,1743,212],{"class":211},[89,1745,1527],{"class":201},[89,1747,229],{"class":205},[89,1749,1586],{"class":99},[89,1751,1752,1754,1756,1758],{"class":91,"data-line":503,"line":503},[89,1753,212],{"class":211},[89,1755,1546],{"class":201},[89,1757,229],{"class":205},[89,1759,1603],{"class":99},[89,1761,1762,1765],{"class":91,"data-line":517,"line":517},[89,1763,1764],{"class":201},"subjects",[89,1766,206],{"class":205},[89,1768,1769,1771,1773,1775,1777],{"class":91,"data-line":524,"line":524},[89,1770,212],{"class":211},[89,1772,286],{"class":205},[89,1774,1527],{"class":201},[89,1776,229],{"class":205},[89,1778,1532],{"class":99},[89,1780,1781,1783,1785,1787,1789],{"class":91,"data-line":531,"line":531},[89,1782,212],{"class":211},[89,1784,212],{"class":211},[89,1786,1546],{"class":201},[89,1788,229],{"class":205},[89,1790,1551],{"class":99},[89,1792,1793,1795,1797,1799,1801],{"class":91,"data-line":541,"line":541},[89,1794,212],{"class":211},[89,1796,212],{"class":211},[89,1798,1558],{"class":201},[89,1800,229],{"class":205},[89,1802,1563],{"class":99},[89,1804,1806],{"class":91,"data-line":1805,"line":1805},28,[89,1807,1568],{"class":95},[89,1809,1811,1813,1815],{"class":91,"data-line":1810,"line":1810},29,[89,1812,1517],{"class":201},[89,1814,229],{"class":205},[89,1816,1522],{"class":99},[89,1818,1820,1822,1824],{"class":91,"data-line":1819,"line":1819},30,[89,1821,1527],{"class":201},[89,1823,229],{"class":205},[89,1825,1826],{"class":99},"ConfigMap\n",[89,1828,1830,1832],{"class":91,"data-line":1829,"line":1829},31,[89,1831,1537],{"class":201},[89,1833,206],{"class":205},[89,1835,1837,1839,1841,1843],{"class":91,"data-line":1836,"line":1836},32,[89,1838,212],{"class":211},[89,1840,1546],{"class":201},[89,1842,229],{"class":205},[89,1844,1845],{"class":99},"fluent-bit-config\n",[89,1847,1849,1851,1853,1855],{"class":91,"data-line":1848,"line":1848},33,[89,1850,212],{"class":211},[89,1852,1558],{"class":201},[89,1854,229],{"class":205},[89,1856,1563],{"class":99},[89,1858,1860,1863],{"class":91,"data-line":1859,"line":1859},34,[89,1861,1862],{"class":201},"data",[89,1864,206],{"class":205},[89,1866,1868,1870,1873,1875],{"class":91,"data-line":1867,"line":1867},35,[89,1869,212],{"class":211},[89,1871,1872],{"class":201},"fluent-bit.conf",[89,1874,229],{"class":205},[89,1876,1877],{"class":580},"|\n",[89,1879,1881,1883,1885],{"class":91,"data-line":1880,"line":1880},36,[89,1882,212],{"class":211},[89,1884,212],{"class":211},[89,1886,1887],{"class":99},"[SERVICE]\n",[89,1889,1891,1893,1895,1897,1899],{"class":91,"data-line":1890,"line":1890},37,[89,1892,212],{"class":211},[89,1894,212],{"class":211},[89,1896,212],{"class":211},[89,1898,212],{"class":211},[89,1900,1901],{"class":99},"Flush 2\n",[89,1903,1905,1907,1909,1911,1913],{"class":91,"data-line":1904,"line":1904},38,[89,1906,212],{"class":211},[89,1908,212],{"class":211},[89,1910,212],{"class":211},[89,1912,212],{"class":211},[89,1914,1915],{"class":99},"Grace 30\n",[89,1917,1919,1921,1923,1925,1927],{"class":91,"data-line":1918,"line":1918},39,[89,1920,212],{"class":211},[89,1922,212],{"class":211},[89,1924,212],{"class":211},[89,1926,212],{"class":211},[89,1928,1929],{"class":99},"Log_Level info\n",[89,1931,1933,1935,1937,1939,1941],{"class":91,"data-line":1932,"line":1932},40,[89,1934,212],{"class":211},[89,1936,212],{"class":211},[89,1938,212],{"class":211},[89,1940,212],{"class":211},[89,1942,1943],{"class":99},"Daemon off\n",[89,1945,1947,1949,1951,1953,1955],{"class":91,"data-line":1946,"line":1946},41,[89,1948,212],{"class":211},[89,1950,212],{"class":211},[89,1952,212],{"class":211},[89,1954,212],{"class":211},[89,1956,1957],{"class":99},"Parsers_File parsers.conf\n",[89,1959,1961,1963,1965,1967,1969],{"class":91,"data-line":1960,"line":1960},42,[89,1962,212],{"class":211},[89,1964,212],{"class":211},[89,1966,212],{"class":211},[89,1968,212],{"class":211},[89,1970,1971],{"class":99},"HTTP_Server on\n",[89,1973,1975,1977,1979,1981,1983],{"class":91,"data-line":1974,"line":1974},43,[89,1976,212],{"class":211},[89,1978,212],{"class":211},[89,1980,212],{"class":211},[89,1982,212],{"class":211},[89,1984,1985],{"class":99},"HTTP_Listen 0.0.0.0\n",[89,1987,1989,1991,1993,1995,1997],{"class":91,"data-line":1988,"line":1988},44,[89,1990,212],{"class":211},[89,1992,212],{"class":211},[89,1994,212],{"class":211},[89,1996,212],{"class":211},[89,1998,1999],{"class":99},"HTTP_Port 2020\n",[89,2001,2003,2005,2007,2009,2011],{"class":91,"data-line":2002,"line":2002},45,[89,2004,212],{"class":211},[89,2006,212],{"class":211},[89,2008,212],{"class":211},[89,2010,212],{"class":211},[89,2012,2013],{"class":99},"storage.path \u002Fvar\u002Flib\u002Ffluent-bit\u002Fstorage\n",[89,2015,2017,2019,2021,2023,2025],{"class":91,"data-line":2016,"line":2016},46,[89,2018,212],{"class":211},[89,2020,212],{"class":211},[89,2022,212],{"class":211},[89,2024,212],{"class":211},[89,2026,2027],{"class":99},"storage.sync normal\n",[89,2029,2031,2033,2035,2037,2039],{"class":91,"data-line":2030,"line":2030},47,[89,2032,212],{"class":211},[89,2034,212],{"class":211},[89,2036,212],{"class":211},[89,2038,212],{"class":211},[89,2040,2041],{"class":99},"storage.checksum off\n",[89,2043,2045,2047,2049,2051,2053],{"class":91,"data-line":2044,"line":2044},48,[89,2046,212],{"class":211},[89,2048,212],{"class":211},[89,2050,212],{"class":211},[89,2052,212],{"class":211},[89,2054,2055],{"class":99},"storage.max_chunks_up 64\n",[89,2057,2059,2061,2063,2065,2067],{"class":91,"data-line":2058,"line":2058},49,[89,2060,212],{"class":211},[89,2062,212],{"class":211},[89,2064,212],{"class":211},[89,2066,212],{"class":211},[89,2068,2069],{"class":99},"storage.backlog.mem_limit 5M\n",[89,2071,2073],{"class":91,"data-line":2072,"line":2072},50,[89,2074,521],{"emptyLinePlaceholder":520},[89,2076,2078,2080,2082],{"class":91,"data-line":2077,"line":2077},51,[89,2079,212],{"class":211},[89,2081,212],{"class":211},[89,2083,2084],{"class":99},"[INPUT]\n",[89,2086,2088,2090,2092,2094,2096],{"class":91,"data-line":2087,"line":2087},52,[89,2089,212],{"class":211},[89,2091,212],{"class":211},[89,2093,212],{"class":211},[89,2095,212],{"class":211},[89,2097,2098],{"class":99},"Name tail\n",[89,2100,2102,2104,2106,2108,2110],{"class":91,"data-line":2101,"line":2101},53,[89,2103,212],{"class":211},[89,2105,212],{"class":211},[89,2107,212],{"class":211},[89,2109,212],{"class":211},[89,2111,2112],{"class":99},"Tag kube.*\n",[89,2114,2116,2118,2120,2122,2124],{"class":91,"data-line":2115,"line":2115},54,[89,2117,212],{"class":211},[89,2119,212],{"class":211},[89,2121,212],{"class":211},[89,2123,212],{"class":211},[89,2125,2126],{"class":99},"Path \u002Fvar\u002Flog\u002Fcontainers\u002F*_default_*.log\n",[89,2128,2130,2132,2134,2136,2138],{"class":91,"data-line":2129,"line":2129},55,[89,2131,212],{"class":211},[89,2133,212],{"class":211},[89,2135,212],{"class":211},[89,2137,212],{"class":211},[89,2139,2140],{"class":99},"Exclude_Path \u002Fvar\u002Flog\u002Fcontainers\u002Ffluent-bit-*_default_*.log\n",[89,2142,2144,2146,2148,2150,2152],{"class":91,"data-line":2143,"line":2143},56,[89,2145,212],{"class":211},[89,2147,212],{"class":211},[89,2149,212],{"class":211},[89,2151,212],{"class":211},[89,2153,2154],{"class":99},"multiline.parser docker, cri\n",[89,2156,2158,2160,2162,2164,2166],{"class":91,"data-line":2157,"line":2157},57,[89,2159,212],{"class":211},[89,2161,212],{"class":211},[89,2163,212],{"class":211},[89,2165,212],{"class":211},[89,2167,2168],{"class":99},"DB \u002Fvar\u002Flib\u002Ffluent-bit\u002Ftail-containers.db\n",[89,2170,2172,2174,2176,2178,2180],{"class":91,"data-line":2171,"line":2171},58,[89,2173,212],{"class":211},[89,2175,212],{"class":211},[89,2177,212],{"class":211},[89,2179,212],{"class":211},[89,2181,2182],{"class":99},"DB.Sync Normal\n",[89,2184,2186,2188,2190,2192,2194],{"class":91,"data-line":2185,"line":2185},59,[89,2187,212],{"class":211},[89,2189,212],{"class":211},[89,2191,212],{"class":211},[89,2193,212],{"class":211},[89,2195,2196],{"class":99},"Mem_Buf_Limit 5MB\n",[89,2198,2200,2202,2204,2206,2208],{"class":91,"data-line":2199,"line":2199},60,[89,2201,212],{"class":211},[89,2203,212],{"class":211},[89,2205,212],{"class":211},[89,2207,212],{"class":211},[89,2209,2210],{"class":99},"Buffer_Chunk_Size 32KB\n",[89,2212,2214,2216,2218,2220,2222],{"class":91,"data-line":2213,"line":2213},61,[89,2215,212],{"class":211},[89,2217,212],{"class":211},[89,2219,212],{"class":211},[89,2221,212],{"class":211},[89,2223,2224],{"class":99},"Buffer_Max_Size 256KB\n",[89,2226,2228,2230,2232,2234,2236],{"class":91,"data-line":2227,"line":2227},62,[89,2229,212],{"class":211},[89,2231,212],{"class":211},[89,2233,212],{"class":211},[89,2235,212],{"class":211},[89,2237,2238],{"class":99},"Skip_Long_Lines on\n",[89,2240,2242,2244,2246,2248,2250],{"class":91,"data-line":2241,"line":2241},63,[89,2243,212],{"class":211},[89,2245,212],{"class":211},[89,2247,212],{"class":211},[89,2249,212],{"class":211},[89,2251,2252],{"class":99},"Refresh_Interval 10\n",[89,2254,2256,2258,2260,2262,2264],{"class":91,"data-line":2255,"line":2255},64,[89,2257,212],{"class":211},[89,2259,212],{"class":211},[89,2261,212],{"class":211},[89,2263,212],{"class":211},[89,2265,2266],{"class":99},"Rotate_Wait 30\n",[89,2268,2270,2272,2274,2276,2278],{"class":91,"data-line":2269,"line":2269},65,[89,2271,212],{"class":211},[89,2273,212],{"class":211},[89,2275,212],{"class":211},[89,2277,212],{"class":211},[89,2279,2280],{"class":99},"storage.type filesystem\n",[89,2282,2284],{"class":91,"data-line":2283,"line":2283},66,[89,2285,521],{"emptyLinePlaceholder":520},[89,2287,2289,2291,2293],{"class":91,"data-line":2288,"line":2288},67,[89,2290,212],{"class":211},[89,2292,212],{"class":211},[89,2294,2295],{"class":99},"[FILTER]\n",[89,2297,2299,2301,2303,2305,2307],{"class":91,"data-line":2298,"line":2298},68,[89,2300,212],{"class":211},[89,2302,212],{"class":211},[89,2304,212],{"class":211},[89,2306,212],{"class":211},[89,2308,2309],{"class":99},"Name kubernetes\n",[89,2311,2313,2315,2317,2319,2321],{"class":91,"data-line":2312,"line":2312},69,[89,2314,212],{"class":211},[89,2316,212],{"class":211},[89,2318,212],{"class":211},[89,2320,212],{"class":211},[89,2322,2323],{"class":99},"Match kube.*\n",[89,2325,2327,2329,2331,2333,2335],{"class":91,"data-line":2326,"line":2326},70,[89,2328,212],{"class":211},[89,2330,212],{"class":211},[89,2332,212],{"class":211},[89,2334,212],{"class":211},[89,2336,2337],{"class":99},"Kube_URL https:\u002F\u002Fkubernetes.default.svc:443\n",[89,2339,2341,2343,2345,2347,2349],{"class":91,"data-line":2340,"line":2340},71,[89,2342,212],{"class":211},[89,2344,212],{"class":211},[89,2346,212],{"class":211},[89,2348,212],{"class":211},[89,2350,2351],{"class":99},"Kube_CA_File \u002Fvar\u002Frun\u002Fsecrets\u002Fkubernetes.io\u002Fserviceaccount\u002Fca.crt\n",[89,2353,2355,2357,2359,2361,2363],{"class":91,"data-line":2354,"line":2354},72,[89,2356,212],{"class":211},[89,2358,212],{"class":211},[89,2360,212],{"class":211},[89,2362,212],{"class":211},[89,2364,2365],{"class":99},"Kube_Token_File \u002Fvar\u002Frun\u002Fsecrets\u002Fkubernetes.io\u002Fserviceaccount\u002Ftoken\n",[89,2367,2369,2371,2373,2375,2377],{"class":91,"data-line":2368,"line":2368},73,[89,2370,212],{"class":211},[89,2372,212],{"class":211},[89,2374,212],{"class":211},[89,2376,212],{"class":211},[89,2378,2379],{"class":99},"Kube_Tag_Prefix kube.var.log.containers.\n",[89,2381,2383,2385,2387,2389,2391],{"class":91,"data-line":2382,"line":2382},74,[89,2384,212],{"class":211},[89,2386,212],{"class":211},[89,2388,212],{"class":211},[89,2390,212],{"class":211},[89,2392,2393],{"class":99},"Merge_Log on\n",[89,2395,2397,2399,2401,2403,2405],{"class":91,"data-line":2396,"line":2396},75,[89,2398,212],{"class":211},[89,2400,212],{"class":211},[89,2402,212],{"class":211},[89,2404,212],{"class":211},[89,2406,2407],{"class":99},"Keep_Log off\n",[89,2409,2411,2413,2415,2417,2419],{"class":91,"data-line":2410,"line":2410},76,[89,2412,212],{"class":211},[89,2414,212],{"class":211},[89,2416,212],{"class":211},[89,2418,212],{"class":211},[89,2420,2421],{"class":99},"K8S-Logging.Parser on\n",[89,2423,2425,2427,2429,2431,2433],{"class":91,"data-line":2424,"line":2424},77,[89,2426,212],{"class":211},[89,2428,212],{"class":211},[89,2430,212],{"class":211},[89,2432,212],{"class":211},[89,2434,2435],{"class":99},"K8S-Logging.Exclude on\n",[89,2437,2439,2441,2443,2445,2447],{"class":91,"data-line":2438,"line":2438},78,[89,2440,212],{"class":211},[89,2442,212],{"class":211},[89,2444,212],{"class":211},[89,2446,212],{"class":211},[89,2448,2449],{"class":99},"Labels on\n",[89,2451,2453,2455,2457,2459,2461],{"class":91,"data-line":2452,"line":2452},79,[89,2454,212],{"class":211},[89,2456,212],{"class":211},[89,2458,212],{"class":211},[89,2460,212],{"class":211},[89,2462,2463],{"class":99},"Annotations off\n",[89,2465,2467],{"class":91,"data-line":2466,"line":2466},80,[89,2468,521],{"emptyLinePlaceholder":520},[89,2470,2472,2474,2476],{"class":91,"data-line":2471,"line":2471},81,[89,2473,212],{"class":211},[89,2475,212],{"class":211},[89,2477,2478],{"class":99},"[OUTPUT]\n",[89,2480,2482,2484,2486,2488,2490],{"class":91,"data-line":2481,"line":2481},82,[89,2483,212],{"class":211},[89,2485,212],{"class":211},[89,2487,212],{"class":211},[89,2489,212],{"class":211},[89,2491,2492],{"class":99},"Name es\n",[89,2494,2496,2498,2500,2502,2504],{"class":91,"data-line":2495,"line":2495},83,[89,2497,212],{"class":211},[89,2499,212],{"class":211},[89,2501,212],{"class":211},[89,2503,212],{"class":211},[89,2505,2323],{"class":99},[89,2507,2509,2511,2513,2515,2517],{"class":91,"data-line":2508,"line":2508},84,[89,2510,212],{"class":211},[89,2512,212],{"class":211},[89,2514,212],{"class":211},[89,2516,212],{"class":211},[89,2518,2519],{"class":99},"Host ${ES_HOST}\n",[89,2521,2523,2525,2527,2529,2531],{"class":91,"data-line":2522,"line":2522},85,[89,2524,212],{"class":211},[89,2526,212],{"class":211},[89,2528,212],{"class":211},[89,2530,212],{"class":211},[89,2532,2533],{"class":99},"Port 9200\n",[89,2535,2537,2539,2541,2543,2545],{"class":91,"data-line":2536,"line":2536},86,[89,2538,212],{"class":211},[89,2540,212],{"class":211},[89,2542,212],{"class":211},[89,2544,212],{"class":211},[89,2546,2547],{"class":99},"HTTP_User ${ES_USER}\n",[89,2549,2551,2553,2555,2557,2559],{"class":91,"data-line":2550,"line":2550},87,[89,2552,212],{"class":211},[89,2554,212],{"class":211},[89,2556,212],{"class":211},[89,2558,212],{"class":211},[89,2560,2561],{"class":99},"HTTP_Passwd ${ES_PASSWORD}\n",[89,2563,2565,2567,2569,2571,2573],{"class":91,"data-line":2564,"line":2564},88,[89,2566,212],{"class":211},[89,2568,212],{"class":211},[89,2570,212],{"class":211},[89,2572,212],{"class":211},[89,2574,2575],{"class":99},"Logstash_Format on\n",[89,2577,2579,2581,2583,2585,2587],{"class":91,"data-line":2578,"line":2578},89,[89,2580,212],{"class":211},[89,2582,212],{"class":211},[89,2584,212],{"class":211},[89,2586,212],{"class":211},[89,2588,2589],{"class":99},"Logstash_Prefix k8s-logs\n",[89,2591,2593,2595,2597,2599,2601],{"class":91,"data-line":2592,"line":2592},90,[89,2594,212],{"class":211},[89,2596,212],{"class":211},[89,2598,212],{"class":211},[89,2600,212],{"class":211},[89,2602,2603],{"class":99},"Suppress_Type_Name on\n",[89,2605,2607,2609,2611,2613,2615],{"class":91,"data-line":2606,"line":2606},91,[89,2608,212],{"class":211},[89,2610,212],{"class":211},[89,2612,212],{"class":211},[89,2614,212],{"class":211},[89,2616,2617],{"class":99},"Generate_ID on\n",[89,2619,2621,2623,2625,2627,2629],{"class":91,"data-line":2620,"line":2620},92,[89,2622,212],{"class":211},[89,2624,212],{"class":211},[89,2626,212],{"class":211},[89,2628,212],{"class":211},[89,2630,2631],{"class":99},"Replace_Dots on\n",[89,2633,2635,2637,2639,2641,2643],{"class":91,"data-line":2634,"line":2634},93,[89,2636,212],{"class":211},[89,2638,212],{"class":211},[89,2640,212],{"class":211},[89,2642,212],{"class":211},[89,2644,2645],{"class":99},"Workers 1\n",[89,2647,2649,2651,2653,2655,2657],{"class":91,"data-line":2648,"line":2648},94,[89,2650,212],{"class":211},[89,2652,212],{"class":211},[89,2654,212],{"class":211},[89,2656,212],{"class":211},[89,2658,2659],{"class":99},"Retry_Limit False\n",[89,2661,2663],{"class":91,"data-line":2662,"line":2662},95,[89,2664,1568],{"class":95},[89,2666,2668,2670,2672],{"class":91,"data-line":2667,"line":2667},96,[89,2669,1517],{"class":201},[89,2671,229],{"class":205},[89,2673,2674],{"class":99},"apps\u002Fv1\n",[89,2676,2678,2680,2682],{"class":91,"data-line":2677,"line":2677},97,[89,2679,1527],{"class":201},[89,2681,229],{"class":205},[89,2683,2684],{"class":99},"DaemonSet\n",[89,2686,2688,2690],{"class":91,"data-line":2687,"line":2687},98,[89,2689,1537],{"class":201},[89,2691,206],{"class":205},[89,2693,2695,2697,2699,2701],{"class":91,"data-line":2694,"line":2694},99,[89,2696,212],{"class":211},[89,2698,1546],{"class":201},[89,2700,229],{"class":205},[89,2702,1551],{"class":99},[89,2704,2706,2708,2710,2712],{"class":91,"data-line":2705,"line":2705},100,[89,2707,212],{"class":211},[89,2709,1558],{"class":201},[89,2711,229],{"class":205},[89,2713,1563],{"class":99},[89,2715,2717,2719,2722],{"class":91,"data-line":2716,"line":2716},101,[89,2718,212],{"class":211},[89,2720,2721],{"class":201},"labels",[89,2723,206],{"class":205},[89,2725,2727,2729,2731,2734,2736],{"class":91,"data-line":2726,"line":2726},102,[89,2728,212],{"class":211},[89,2730,212],{"class":211},[89,2732,2733],{"class":201},"app.kubernetes.io\u002Fname",[89,2735,229],{"class":205},[89,2737,1551],{"class":99},[89,2739,2741,2743,2745,2748,2750],{"class":91,"data-line":2740,"line":2740},103,[89,2742,212],{"class":211},[89,2744,212],{"class":211},[89,2746,2747],{"class":201},"app.kubernetes.io\u002Fpart-of",[89,2749,229],{"class":205},[89,2751,2752],{"class":99},"logging\n",[89,2754,2756,2759],{"class":91,"data-line":2755,"line":2755},104,[89,2757,2758],{"class":201},"spec",[89,2760,206],{"class":205},[89,2762,2764,2766,2769],{"class":91,"data-line":2763,"line":2763},105,[89,2765,212],{"class":211},[89,2767,2768],{"class":201},"selector",[89,2770,206],{"class":205},[89,2772,2774,2776,2778,2781],{"class":91,"data-line":2773,"line":2773},106,[89,2775,212],{"class":211},[89,2777,212],{"class":211},[89,2779,2780],{"class":201},"matchLabels",[89,2782,206],{"class":205},[89,2784,2786,2788,2790,2792,2794,2796],{"class":91,"data-line":2785,"line":2785},107,[89,2787,212],{"class":211},[89,2789,212],{"class":211},[89,2791,212],{"class":211},[89,2793,2733],{"class":201},[89,2795,229],{"class":205},[89,2797,1551],{"class":99},[89,2799,2801,2803,2806],{"class":91,"data-line":2800,"line":2800},108,[89,2802,212],{"class":211},[89,2804,2805],{"class":201},"template",[89,2807,206],{"class":205},[89,2809,2811,2813,2815,2817],{"class":91,"data-line":2810,"line":2810},109,[89,2812,212],{"class":211},[89,2814,212],{"class":211},[89,2816,1537],{"class":201},[89,2818,206],{"class":205},[89,2820,2822,2824,2826,2828,2830],{"class":91,"data-line":2821,"line":2821},110,[89,2823,212],{"class":211},[89,2825,212],{"class":211},[89,2827,212],{"class":211},[89,2829,2721],{"class":201},[89,2831,206],{"class":205},[89,2833,2835,2837,2839,2841,2843,2845,2847],{"class":91,"data-line":2834,"line":2834},111,[89,2836,212],{"class":211},[89,2838,212],{"class":211},[89,2840,212],{"class":211},[89,2842,212],{"class":211},[89,2844,2733],{"class":201},[89,2846,229],{"class":205},[89,2848,1551],{"class":99},[89,2850,2852,2854,2856,2858,2860,2862,2864],{"class":91,"data-line":2851,"line":2851},112,[89,2853,212],{"class":211},[89,2855,212],{"class":211},[89,2857,212],{"class":211},[89,2859,212],{"class":211},[89,2861,2747],{"class":201},[89,2863,229],{"class":205},[89,2865,2752],{"class":99},[89,2867,2869,2871,2873,2875,2878],{"class":91,"data-line":2868,"line":2868},113,[89,2870,212],{"class":211},[89,2872,212],{"class":211},[89,2874,212],{"class":211},[89,2876,2877],{"class":201},"annotations",[89,2879,206],{"class":205},[89,2881,2883,2885,2887,2889,2891,2894,2896],{"class":91,"data-line":2882,"line":2882},114,[89,2884,212],{"class":211},[89,2886,212],{"class":211},[89,2888,212],{"class":211},[89,2890,212],{"class":211},[89,2892,2893],{"class":201},"fluentbit.io\u002Fexclude",[89,2895,229],{"class":205},[89,2897,2898],{"class":99},"\"true\"\n",[89,2900,2902,2904,2906,2908],{"class":91,"data-line":2901,"line":2901},115,[89,2903,212],{"class":211},[89,2905,212],{"class":211},[89,2907,2758],{"class":201},[89,2909,206],{"class":205},[89,2911,2913,2915,2917,2919,2922,2924],{"class":91,"data-line":2912,"line":2912},116,[89,2914,212],{"class":211},[89,2916,212],{"class":211},[89,2918,212],{"class":211},[89,2920,2921],{"class":201},"serviceAccountName",[89,2923,229],{"class":205},[89,2925,1551],{"class":99},[89,2927,2929,2931,2933,2935,2938,2940],{"class":91,"data-line":2928,"line":2928},117,[89,2930,212],{"class":211},[89,2932,212],{"class":211},[89,2934,212],{"class":211},[89,2936,2937],{"class":201},"terminationGracePeriodSeconds",[89,2939,229],{"class":205},[89,2941,2942],{"class":141},"30\n",[89,2944,2946,2948,2950,2952,2955],{"class":91,"data-line":2945,"line":2945},118,[89,2947,212],{"class":211},[89,2949,212],{"class":211},[89,2951,212],{"class":211},[89,2953,2954],{"class":201},"tolerations",[89,2956,206],{"class":205},[89,2958,2960,2962,2964,2966,2968,2970,2973,2975],{"class":91,"data-line":2959,"line":2959},119,[89,2961,212],{"class":211},[89,2963,212],{"class":211},[89,2965,212],{"class":211},[89,2967,212],{"class":211},[89,2969,286],{"class":205},[89,2971,2972],{"class":201},"operator",[89,2974,229],{"class":205},[89,2976,2977],{"class":99},"Exists\n",[89,2979,2981,2983,2985,2987,2990],{"class":91,"data-line":2980,"line":2980},120,[89,2982,212],{"class":211},[89,2984,212],{"class":211},[89,2986,212],{"class":211},[89,2988,2989],{"class":201},"containers",[89,2991,206],{"class":205},[89,2993,2995,2997,2999,3001,3003,3005,3007,3009],{"class":91,"data-line":2994,"line":2994},121,[89,2996,212],{"class":211},[89,2998,212],{"class":211},[89,3000,212],{"class":211},[89,3002,212],{"class":211},[89,3004,286],{"class":205},[89,3006,1546],{"class":201},[89,3008,229],{"class":205},[89,3010,1551],{"class":99},[89,3012,3014,3016,3018,3020,3022,3024,3026,3028],{"class":91,"data-line":3013,"line":3013},122,[89,3015,212],{"class":211},[89,3017,212],{"class":211},[89,3019,212],{"class":211},[89,3021,212],{"class":211},[89,3023,212],{"class":211},[89,3025,226],{"class":201},[89,3027,229],{"class":205},[89,3029,3030],{"class":99},"fluent\u002Ffluent-bit:5.0.9\n",[89,3032,3034,3036,3038,3040,3042,3044,3047,3049],{"class":91,"data-line":3033,"line":3033},123,[89,3035,212],{"class":211},[89,3037,212],{"class":211},[89,3039,212],{"class":211},[89,3041,212],{"class":211},[89,3043,212],{"class":211},[89,3045,3046],{"class":201},"imagePullPolicy",[89,3048,229],{"class":205},[89,3050,3051],{"class":99},"IfNotPresent\n",[89,3053,3055,3057,3059,3061,3063,3065,3068],{"class":91,"data-line":3054,"line":3054},124,[89,3056,212],{"class":211},[89,3058,212],{"class":211},[89,3060,212],{"class":211},[89,3062,212],{"class":211},[89,3064,212],{"class":211},[89,3066,3067],{"class":201},"env",[89,3069,206],{"class":205},[89,3071,3073,3075,3077,3079,3081,3083,3085,3087,3089,3091],{"class":91,"data-line":3072,"line":3072},125,[89,3074,212],{"class":211},[89,3076,212],{"class":211},[89,3078,212],{"class":211},[89,3080,212],{"class":211},[89,3082,212],{"class":211},[89,3084,212],{"class":211},[89,3086,286],{"class":205},[89,3088,1546],{"class":201},[89,3090,229],{"class":205},[89,3092,3093],{"class":99},"ES_HOST\n",[89,3095,3097,3099,3101,3103,3105,3107,3109,3111,3114],{"class":91,"data-line":3096,"line":3096},126,[89,3098,212],{"class":211},[89,3100,212],{"class":211},[89,3102,212],{"class":211},[89,3104,212],{"class":211},[89,3106,212],{"class":211},[89,3108,212],{"class":211},[89,3110,212],{"class":211},[89,3112,3113],{"class":201},"valueFrom",[89,3115,206],{"class":205},[89,3117,3119,3121,3123,3125,3127,3129,3131,3133,3135,3138],{"class":91,"data-line":3118,"line":3118},127,[89,3120,212],{"class":211},[89,3122,212],{"class":211},[89,3124,212],{"class":211},[89,3126,212],{"class":211},[89,3128,212],{"class":211},[89,3130,212],{"class":211},[89,3132,212],{"class":211},[89,3134,212],{"class":211},[89,3136,3137],{"class":201},"secretKeyRef",[89,3139,206],{"class":205},[89,3141,3143,3145,3147,3149,3151,3153,3155,3157,3159,3161,3163,3165],{"class":91,"data-line":3142,"line":3142},128,[89,3144,212],{"class":211},[89,3146,212],{"class":211},[89,3148,212],{"class":211},[89,3150,212],{"class":211},[89,3152,212],{"class":211},[89,3154,212],{"class":211},[89,3156,212],{"class":211},[89,3158,212],{"class":211},[89,3160,212],{"class":211},[89,3162,1546],{"class":201},[89,3164,229],{"class":205},[89,3166,3167],{"class":99},"fluent-bit-es-auth\n",[89,3169,3171,3173,3175,3177,3179,3181,3183,3185,3187,3189,3192,3194],{"class":91,"data-line":3170,"line":3170},129,[89,3172,212],{"class":211},[89,3174,212],{"class":211},[89,3176,212],{"class":211},[89,3178,212],{"class":211},[89,3180,212],{"class":211},[89,3182,212],{"class":211},[89,3184,212],{"class":211},[89,3186,212],{"class":211},[89,3188,212],{"class":211},[89,3190,3191],{"class":201},"key",[89,3193,229],{"class":205},[89,3195,3196],{"class":99},"host\n",[89,3198,3200,3202,3204,3206,3208,3210,3212,3214,3216,3218],{"class":91,"data-line":3199,"line":3199},130,[89,3201,212],{"class":211},[89,3203,212],{"class":211},[89,3205,212],{"class":211},[89,3207,212],{"class":211},[89,3209,212],{"class":211},[89,3211,212],{"class":211},[89,3213,286],{"class":205},[89,3215,1546],{"class":201},[89,3217,229],{"class":205},[89,3219,3220],{"class":99},"ES_USER\n",[89,3222,3224,3226,3228,3230,3232,3234,3236,3238,3240],{"class":91,"data-line":3223,"line":3223},131,[89,3225,212],{"class":211},[89,3227,212],{"class":211},[89,3229,212],{"class":211},[89,3231,212],{"class":211},[89,3233,212],{"class":211},[89,3235,212],{"class":211},[89,3237,212],{"class":211},[89,3239,3113],{"class":201},[89,3241,206],{"class":205},[89,3243,3245,3247,3249,3251,3253,3255,3257,3259,3261,3263],{"class":91,"data-line":3244,"line":3244},132,[89,3246,212],{"class":211},[89,3248,212],{"class":211},[89,3250,212],{"class":211},[89,3252,212],{"class":211},[89,3254,212],{"class":211},[89,3256,212],{"class":211},[89,3258,212],{"class":211},[89,3260,212],{"class":211},[89,3262,3137],{"class":201},[89,3264,206],{"class":205},[89,3266,3268,3270,3272,3274,3276,3278,3280,3282,3284,3286,3288,3290],{"class":91,"data-line":3267,"line":3267},133,[89,3269,212],{"class":211},[89,3271,212],{"class":211},[89,3273,212],{"class":211},[89,3275,212],{"class":211},[89,3277,212],{"class":211},[89,3279,212],{"class":211},[89,3281,212],{"class":211},[89,3283,212],{"class":211},[89,3285,212],{"class":211},[89,3287,1546],{"class":201},[89,3289,229],{"class":205},[89,3291,3167],{"class":99},[89,3293,3295,3297,3299,3301,3303,3305,3307,3309,3311,3313,3315,3317],{"class":91,"data-line":3294,"line":3294},134,[89,3296,212],{"class":211},[89,3298,212],{"class":211},[89,3300,212],{"class":211},[89,3302,212],{"class":211},[89,3304,212],{"class":211},[89,3306,212],{"class":211},[89,3308,212],{"class":211},[89,3310,212],{"class":211},[89,3312,212],{"class":211},[89,3314,3191],{"class":201},[89,3316,229],{"class":205},[89,3318,3319],{"class":99},"username\n",[89,3321,3323,3325,3327,3329,3331,3333,3335,3337,3339,3341],{"class":91,"data-line":3322,"line":3322},135,[89,3324,212],{"class":211},[89,3326,212],{"class":211},[89,3328,212],{"class":211},[89,3330,212],{"class":211},[89,3332,212],{"class":211},[89,3334,212],{"class":211},[89,3336,286],{"class":205},[89,3338,1546],{"class":201},[89,3340,229],{"class":205},[89,3342,3343],{"class":99},"ES_PASSWORD\n",[89,3345,3347,3349,3351,3353,3355,3357,3359,3361,3363],{"class":91,"data-line":3346,"line":3346},136,[89,3348,212],{"class":211},[89,3350,212],{"class":211},[89,3352,212],{"class":211},[89,3354,212],{"class":211},[89,3356,212],{"class":211},[89,3358,212],{"class":211},[89,3360,212],{"class":211},[89,3362,3113],{"class":201},[89,3364,206],{"class":205},[89,3366,3368,3370,3372,3374,3376,3378,3380,3382,3384,3386],{"class":91,"data-line":3367,"line":3367},137,[89,3369,212],{"class":211},[89,3371,212],{"class":211},[89,3373,212],{"class":211},[89,3375,212],{"class":211},[89,3377,212],{"class":211},[89,3379,212],{"class":211},[89,3381,212],{"class":211},[89,3383,212],{"class":211},[89,3385,3137],{"class":201},[89,3387,206],{"class":205},[89,3389,3391,3393,3395,3397,3399,3401,3403,3405,3407,3409,3411,3413],{"class":91,"data-line":3390,"line":3390},138,[89,3392,212],{"class":211},[89,3394,212],{"class":211},[89,3396,212],{"class":211},[89,3398,212],{"class":211},[89,3400,212],{"class":211},[89,3402,212],{"class":211},[89,3404,212],{"class":211},[89,3406,212],{"class":211},[89,3408,212],{"class":211},[89,3410,1546],{"class":201},[89,3412,229],{"class":205},[89,3414,3167],{"class":99},[89,3416,3418,3420,3422,3424,3426,3428,3430,3432,3434,3436,3438,3440],{"class":91,"data-line":3417,"line":3417},139,[89,3419,212],{"class":211},[89,3421,212],{"class":211},[89,3423,212],{"class":211},[89,3425,212],{"class":211},[89,3427,212],{"class":211},[89,3429,212],{"class":211},[89,3431,212],{"class":211},[89,3433,212],{"class":211},[89,3435,212],{"class":211},[89,3437,3191],{"class":201},[89,3439,229],{"class":205},[89,3441,3442],{"class":99},"password\n",[89,3444,3446,3448,3450,3452,3454,3456,3458],{"class":91,"data-line":3445,"line":3445},140,[89,3447,212],{"class":211},[89,3449,212],{"class":211},[89,3451,212],{"class":211},[89,3453,212],{"class":211},[89,3455,212],{"class":211},[89,3457,432],{"class":201},[89,3459,206],{"class":205},[89,3461,3463,3465,3467,3469,3471,3473,3475,3477,3479,3481],{"class":91,"data-line":3462,"line":3462},141,[89,3464,212],{"class":211},[89,3466,212],{"class":211},[89,3468,212],{"class":211},[89,3470,212],{"class":211},[89,3472,212],{"class":211},[89,3474,212],{"class":211},[89,3476,286],{"class":205},[89,3478,1546],{"class":201},[89,3480,229],{"class":205},[89,3482,3483],{"class":99},"health\n",[89,3485,3487,3489,3491,3493,3495,3497,3499,3501,3504,3506],{"class":91,"data-line":3486,"line":3486},142,[89,3488,212],{"class":211},[89,3490,212],{"class":211},[89,3492,212],{"class":211},[89,3494,212],{"class":211},[89,3496,212],{"class":211},[89,3498,212],{"class":211},[89,3500,212],{"class":211},[89,3502,3503],{"class":201},"containerPort",[89,3505,229],{"class":205},[89,3507,3508],{"class":141},"2020\n",[89,3510,3512,3514,3516,3518,3520,3522,3524,3526,3529,3531],{"class":91,"data-line":3511,"line":3511},143,[89,3513,212],{"class":211},[89,3515,212],{"class":211},[89,3517,212],{"class":211},[89,3519,212],{"class":211},[89,3521,212],{"class":211},[89,3523,212],{"class":211},[89,3525,212],{"class":211},[89,3527,3528],{"class":201},"protocol",[89,3530,229],{"class":205},[89,3532,3533],{"class":99},"TCP\n",[89,3535,3537,3539,3541,3543,3545,3547,3550],{"class":91,"data-line":3536,"line":3536},144,[89,3538,212],{"class":211},[89,3540,212],{"class":211},[89,3542,212],{"class":211},[89,3544,212],{"class":211},[89,3546,212],{"class":211},[89,3548,3549],{"class":201},"livenessProbe",[89,3551,206],{"class":205},[89,3553,3555,3557,3559,3561,3563,3565,3567,3570],{"class":91,"data-line":3554,"line":3554},145,[89,3556,212],{"class":211},[89,3558,212],{"class":211},[89,3560,212],{"class":211},[89,3562,212],{"class":211},[89,3564,212],{"class":211},[89,3566,212],{"class":211},[89,3568,3569],{"class":201},"httpGet",[89,3571,206],{"class":205},[89,3573,3575,3577,3579,3581,3583,3585,3587,3589,3592,3594],{"class":91,"data-line":3574,"line":3574},146,[89,3576,212],{"class":211},[89,3578,212],{"class":211},[89,3580,212],{"class":211},[89,3582,212],{"class":211},[89,3584,212],{"class":211},[89,3586,212],{"class":211},[89,3588,212],{"class":211},[89,3590,3591],{"class":201},"path",[89,3593,229],{"class":205},[89,3595,3596],{"class":99},"\u002Fapi\u002Fv1\u002Fuptime\n",[89,3598,3600,3602,3604,3606,3608,3610,3612,3614,3617,3619],{"class":91,"data-line":3599,"line":3599},147,[89,3601,212],{"class":211},[89,3603,212],{"class":211},[89,3605,212],{"class":211},[89,3607,212],{"class":211},[89,3609,212],{"class":211},[89,3611,212],{"class":211},[89,3613,212],{"class":211},[89,3615,3616],{"class":201},"port",[89,3618,229],{"class":205},[89,3620,3483],{"class":99},[89,3622,3624,3626,3628,3630,3632,3634,3636,3639,3641],{"class":91,"data-line":3623,"line":3623},148,[89,3625,212],{"class":211},[89,3627,212],{"class":211},[89,3629,212],{"class":211},[89,3631,212],{"class":211},[89,3633,212],{"class":211},[89,3635,212],{"class":211},[89,3637,3638],{"class":201},"initialDelaySeconds",[89,3640,229],{"class":205},[89,3642,3643],{"class":141},"10\n",[89,3645,3647,3649,3651,3653,3655,3657,3659,3662,3664],{"class":91,"data-line":3646,"line":3646},149,[89,3648,212],{"class":211},[89,3650,212],{"class":211},[89,3652,212],{"class":211},[89,3654,212],{"class":211},[89,3656,212],{"class":211},[89,3658,212],{"class":211},[89,3660,3661],{"class":201},"periodSeconds",[89,3663,229],{"class":205},[89,3665,3666],{"class":141},"20\n",[89,3668,3670,3672,3674,3676,3678,3680,3683],{"class":91,"data-line":3669,"line":3669},150,[89,3671,212],{"class":211},[89,3673,212],{"class":211},[89,3675,212],{"class":211},[89,3677,212],{"class":211},[89,3679,212],{"class":211},[89,3681,3682],{"class":201},"readinessProbe",[89,3684,206],{"class":205},[89,3686,3688,3690,3692,3694,3696,3698,3700,3702],{"class":91,"data-line":3687,"line":3687},151,[89,3689,212],{"class":211},[89,3691,212],{"class":211},[89,3693,212],{"class":211},[89,3695,212],{"class":211},[89,3697,212],{"class":211},[89,3699,212],{"class":211},[89,3701,3569],{"class":201},[89,3703,206],{"class":205},[89,3705,3707,3709,3711,3713,3715,3717,3719,3721,3723,3725],{"class":91,"data-line":3706,"line":3706},152,[89,3708,212],{"class":211},[89,3710,212],{"class":211},[89,3712,212],{"class":211},[89,3714,212],{"class":211},[89,3716,212],{"class":211},[89,3718,212],{"class":211},[89,3720,212],{"class":211},[89,3722,3591],{"class":201},[89,3724,229],{"class":205},[89,3726,3596],{"class":99},[89,3728,3730,3732,3734,3736,3738,3740,3742,3744,3746,3748],{"class":91,"data-line":3729,"line":3729},153,[89,3731,212],{"class":211},[89,3733,212],{"class":211},[89,3735,212],{"class":211},[89,3737,212],{"class":211},[89,3739,212],{"class":211},[89,3741,212],{"class":211},[89,3743,212],{"class":211},[89,3745,3616],{"class":201},[89,3747,229],{"class":205},[89,3749,3483],{"class":99},[89,3751,3753,3755,3757,3759,3761,3763,3765,3767,3769],{"class":91,"data-line":3752,"line":3752},154,[89,3754,212],{"class":211},[89,3756,212],{"class":211},[89,3758,212],{"class":211},[89,3760,212],{"class":211},[89,3762,212],{"class":211},[89,3764,212],{"class":211},[89,3766,3638],{"class":201},[89,3768,229],{"class":205},[89,3770,3771],{"class":141},"5\n",[89,3773,3775,3777,3779,3781,3783,3785,3787,3789,3791],{"class":91,"data-line":3774,"line":3774},155,[89,3776,212],{"class":211},[89,3778,212],{"class":211},[89,3780,212],{"class":211},[89,3782,212],{"class":211},[89,3784,212],{"class":211},[89,3786,212],{"class":211},[89,3788,3661],{"class":201},[89,3790,229],{"class":205},[89,3792,3643],{"class":141},[89,3794,3796,3798,3800,3802,3804,3806,3808],{"class":91,"data-line":3795,"line":3795},156,[89,3797,212],{"class":211},[89,3799,212],{"class":211},[89,3801,212],{"class":211},[89,3803,212],{"class":211},[89,3805,212],{"class":211},[89,3807,1640],{"class":201},[89,3809,206],{"class":205},[89,3811,3813,3815,3817,3819,3821,3823,3825,3828],{"class":91,"data-line":3812,"line":3812},157,[89,3814,212],{"class":211},[89,3816,212],{"class":211},[89,3818,212],{"class":211},[89,3820,212],{"class":211},[89,3822,212],{"class":211},[89,3824,212],{"class":211},[89,3826,3827],{"class":201},"requests",[89,3829,206],{"class":205},[89,3831,3833,3835,3837,3839,3841,3843,3845,3847,3850,3852],{"class":91,"data-line":3832,"line":3832},158,[89,3834,212],{"class":211},[89,3836,212],{"class":211},[89,3838,212],{"class":211},[89,3840,212],{"class":211},[89,3842,212],{"class":211},[89,3844,212],{"class":211},[89,3846,212],{"class":211},[89,3848,3849],{"class":201},"cpu",[89,3851,229],{"class":205},[89,3853,3854],{"class":99},"20m\n",[89,3856,3858,3860,3862,3864,3866,3868,3870,3872,3875,3877],{"class":91,"data-line":3857,"line":3857},159,[89,3859,212],{"class":211},[89,3861,212],{"class":211},[89,3863,212],{"class":211},[89,3865,212],{"class":211},[89,3867,212],{"class":211},[89,3869,212],{"class":211},[89,3871,212],{"class":211},[89,3873,3874],{"class":201},"memory",[89,3876,229],{"class":205},[89,3878,3879],{"class":99},"30Mi\n",[89,3881,3883,3885,3887,3889,3891,3893,3895,3898],{"class":91,"data-line":3882,"line":3882},160,[89,3884,212],{"class":211},[89,3886,212],{"class":211},[89,3888,212],{"class":211},[89,3890,212],{"class":211},[89,3892,212],{"class":211},[89,3894,212],{"class":211},[89,3896,3897],{"class":201},"limits",[89,3899,206],{"class":205},[89,3901,3903,3905,3907,3909,3911,3913,3915,3917,3919,3921],{"class":91,"data-line":3902,"line":3902},161,[89,3904,212],{"class":211},[89,3906,212],{"class":211},[89,3908,212],{"class":211},[89,3910,212],{"class":211},[89,3912,212],{"class":211},[89,3914,212],{"class":211},[89,3916,212],{"class":211},[89,3918,3849],{"class":201},[89,3920,229],{"class":205},[89,3922,3923],{"class":99},"150m\n",[89,3925,3927,3929,3931,3933,3935,3937,3939,3941,3943,3945],{"class":91,"data-line":3926,"line":3926},162,[89,3928,212],{"class":211},[89,3930,212],{"class":211},[89,3932,212],{"class":211},[89,3934,212],{"class":211},[89,3936,212],{"class":211},[89,3938,212],{"class":211},[89,3940,212],{"class":211},[89,3942,3874],{"class":201},[89,3944,229],{"class":205},[89,3946,3947],{"class":99},"96Mi\n",[89,3949,3951,3953,3955,3957,3959,3961,3964],{"class":91,"data-line":3950,"line":3950},163,[89,3952,212],{"class":211},[89,3954,212],{"class":211},[89,3956,212],{"class":211},[89,3958,212],{"class":211},[89,3960,212],{"class":211},[89,3962,3963],{"class":201},"volumeMounts",[89,3965,206],{"class":205},[89,3967,3969,3971,3973,3975,3977,3979,3981,3983,3985,3987],{"class":91,"data-line":3968,"line":3968},164,[89,3970,212],{"class":211},[89,3972,212],{"class":211},[89,3974,212],{"class":211},[89,3976,212],{"class":211},[89,3978,212],{"class":211},[89,3980,212],{"class":211},[89,3982,286],{"class":205},[89,3984,1546],{"class":201},[89,3986,229],{"class":205},[89,3988,3989],{"class":99},"config\n",[89,3991,3993,3995,3997,3999,4001,4003,4005,4007,4010,4012],{"class":91,"data-line":3992,"line":3992},165,[89,3994,212],{"class":211},[89,3996,212],{"class":211},[89,3998,212],{"class":211},[89,4000,212],{"class":211},[89,4002,212],{"class":211},[89,4004,212],{"class":211},[89,4006,212],{"class":211},[89,4008,4009],{"class":201},"mountPath",[89,4011,229],{"class":205},[89,4013,4014],{"class":99},"\u002Ffluent-bit\u002Fetc\u002Ffluent-bit.conf\n",[89,4016,4018,4020,4022,4024,4026,4028,4030,4032,4035,4037],{"class":91,"data-line":4017,"line":4017},166,[89,4019,212],{"class":211},[89,4021,212],{"class":211},[89,4023,212],{"class":211},[89,4025,212],{"class":211},[89,4027,212],{"class":211},[89,4029,212],{"class":211},[89,4031,212],{"class":211},[89,4033,4034],{"class":201},"subPath",[89,4036,229],{"class":205},[89,4038,4039],{"class":99},"fluent-bit.conf\n",[89,4041,4043,4045,4047,4049,4051,4053,4055,4057,4060,4062],{"class":91,"data-line":4042,"line":4042},167,[89,4044,212],{"class":211},[89,4046,212],{"class":211},[89,4048,212],{"class":211},[89,4050,212],{"class":211},[89,4052,212],{"class":211},[89,4054,212],{"class":211},[89,4056,212],{"class":211},[89,4058,4059],{"class":201},"readOnly",[89,4061,229],{"class":205},[89,4063,553],{"class":141},[89,4065,4067,4069,4071,4073,4075,4077,4079,4081,4083,4085],{"class":91,"data-line":4066,"line":4066},168,[89,4068,212],{"class":211},[89,4070,212],{"class":211},[89,4072,212],{"class":211},[89,4074,212],{"class":211},[89,4076,212],{"class":211},[89,4078,212],{"class":211},[89,4080,286],{"class":205},[89,4082,1546],{"class":201},[89,4084,229],{"class":205},[89,4086,4087],{"class":99},"varlog\n",[89,4089,4091,4093,4095,4097,4099,4101,4103,4105,4107,4109],{"class":91,"data-line":4090,"line":4090},169,[89,4092,212],{"class":211},[89,4094,212],{"class":211},[89,4096,212],{"class":211},[89,4098,212],{"class":211},[89,4100,212],{"class":211},[89,4102,212],{"class":211},[89,4104,212],{"class":211},[89,4106,4009],{"class":201},[89,4108,229],{"class":205},[89,4110,4111],{"class":99},"\u002Fvar\u002Flog\n",[89,4113,4115,4117,4119,4121,4123,4125,4127,4129,4131,4133],{"class":91,"data-line":4114,"line":4114},170,[89,4116,212],{"class":211},[89,4118,212],{"class":211},[89,4120,212],{"class":211},[89,4122,212],{"class":211},[89,4124,212],{"class":211},[89,4126,212],{"class":211},[89,4128,212],{"class":211},[89,4130,4059],{"class":201},[89,4132,229],{"class":205},[89,4134,553],{"class":141},[89,4136,4138,4140,4142,4144,4146,4148,4150,4152,4154,4156],{"class":91,"data-line":4137,"line":4137},171,[89,4139,212],{"class":211},[89,4141,212],{"class":211},[89,4143,212],{"class":211},[89,4145,212],{"class":211},[89,4147,212],{"class":211},[89,4149,212],{"class":211},[89,4151,286],{"class":205},[89,4153,1546],{"class":201},[89,4155,229],{"class":205},[89,4157,4158],{"class":99},"state\n",[89,4160,4162,4164,4166,4168,4170,4172,4174,4176,4178,4180],{"class":91,"data-line":4161,"line":4161},172,[89,4163,212],{"class":211},[89,4165,212],{"class":211},[89,4167,212],{"class":211},[89,4169,212],{"class":211},[89,4171,212],{"class":211},[89,4173,212],{"class":211},[89,4175,212],{"class":211},[89,4177,4009],{"class":201},[89,4179,229],{"class":205},[89,4181,4182],{"class":99},"\u002Fvar\u002Flib\u002Ffluent-bit\n",[89,4184,4186,4188,4190,4192,4194],{"class":91,"data-line":4185,"line":4185},173,[89,4187,212],{"class":211},[89,4189,212],{"class":211},[89,4191,212],{"class":211},[89,4193,458],{"class":201},[89,4195,206],{"class":205},[89,4197,4199,4201,4203,4205,4207,4209,4211,4213],{"class":91,"data-line":4198,"line":4198},174,[89,4200,212],{"class":211},[89,4202,212],{"class":211},[89,4204,212],{"class":211},[89,4206,212],{"class":211},[89,4208,286],{"class":205},[89,4210,1546],{"class":201},[89,4212,229],{"class":205},[89,4214,3989],{"class":99},[89,4216,4218,4220,4222,4224,4226,4228,4231],{"class":91,"data-line":4217,"line":4217},175,[89,4219,212],{"class":211},[89,4221,212],{"class":211},[89,4223,212],{"class":211},[89,4225,212],{"class":211},[89,4227,212],{"class":211},[89,4229,4230],{"class":201},"configMap",[89,4232,206],{"class":205},[89,4234,4236,4238,4240,4242,4244,4246,4248,4250,4252],{"class":91,"data-line":4235,"line":4235},176,[89,4237,212],{"class":211},[89,4239,212],{"class":211},[89,4241,212],{"class":211},[89,4243,212],{"class":211},[89,4245,212],{"class":211},[89,4247,212],{"class":211},[89,4249,1546],{"class":201},[89,4251,229],{"class":205},[89,4253,1845],{"class":99},[89,4255,4257,4259,4261,4263,4265,4267,4269,4271],{"class":91,"data-line":4256,"line":4256},177,[89,4258,212],{"class":211},[89,4260,212],{"class":211},[89,4262,212],{"class":211},[89,4264,212],{"class":211},[89,4266,286],{"class":205},[89,4268,1546],{"class":201},[89,4270,229],{"class":205},[89,4272,4087],{"class":99},[89,4274,4276,4278,4280,4282,4284,4286,4289],{"class":91,"data-line":4275,"line":4275},178,[89,4277,212],{"class":211},[89,4279,212],{"class":211},[89,4281,212],{"class":211},[89,4283,212],{"class":211},[89,4285,212],{"class":211},[89,4287,4288],{"class":201},"hostPath",[89,4290,206],{"class":205},[89,4292,4294,4296,4298,4300,4302,4304,4306,4308,4310],{"class":91,"data-line":4293,"line":4293},179,[89,4295,212],{"class":211},[89,4297,212],{"class":211},[89,4299,212],{"class":211},[89,4301,212],{"class":211},[89,4303,212],{"class":211},[89,4305,212],{"class":211},[89,4307,3591],{"class":201},[89,4309,229],{"class":205},[89,4311,4111],{"class":99},[89,4313,4315,4317,4319,4321,4323,4325,4327,4330,4332],{"class":91,"data-line":4314,"line":4314},180,[89,4316,212],{"class":211},[89,4318,212],{"class":211},[89,4320,212],{"class":211},[89,4322,212],{"class":211},[89,4324,212],{"class":211},[89,4326,212],{"class":211},[89,4328,4329],{"class":201},"type",[89,4331,229],{"class":205},[89,4333,4334],{"class":99},"Directory\n",[89,4336,4338,4340,4342,4344,4346,4348,4350,4352],{"class":91,"data-line":4337,"line":4337},181,[89,4339,212],{"class":211},[89,4341,212],{"class":211},[89,4343,212],{"class":211},[89,4345,212],{"class":211},[89,4347,286],{"class":205},[89,4349,1546],{"class":201},[89,4351,229],{"class":205},[89,4353,4158],{"class":99},[89,4355,4357,4359,4361,4363,4365,4367,4369],{"class":91,"data-line":4356,"line":4356},182,[89,4358,212],{"class":211},[89,4360,212],{"class":211},[89,4362,212],{"class":211},[89,4364,212],{"class":211},[89,4366,212],{"class":211},[89,4368,4288],{"class":201},[89,4370,206],{"class":205},[89,4372,4374,4376,4378,4380,4382,4384,4386,4388,4390],{"class":91,"data-line":4373,"line":4373},183,[89,4375,212],{"class":211},[89,4377,212],{"class":211},[89,4379,212],{"class":211},[89,4381,212],{"class":211},[89,4383,212],{"class":211},[89,4385,212],{"class":211},[89,4387,3591],{"class":201},[89,4389,229],{"class":205},[89,4391,4182],{"class":99},[89,4393,4395,4397,4399,4401,4403,4405,4407,4409,4411],{"class":91,"data-line":4394,"line":4394},184,[89,4396,212],{"class":211},[89,4398,212],{"class":211},[89,4400,212],{"class":211},[89,4402,212],{"class":211},[89,4404,212],{"class":211},[89,4406,212],{"class":211},[89,4408,4329],{"class":201},[89,4410,229],{"class":205},[89,4412,4413],{"class":99},"DirectoryOrCreate\n",[10,4415,4416],{},"部署并观察状态：",[32,4418,4420],{"className":83,"code":4419,"language":85,"meta":38,"style":38},"kubectl apply -f fluent-bit.yaml\nkubectl -n default rollout status daemonset\u002Ffluent-bit\nkubectl -n default get pods -o wide\nkubectl -n default logs daemonset\u002Ffluent-bit --tail=100\n",[14,4421,4422,4434,4451,4471],{"__ignoreMap":38},[89,4423,4424,4426,4429,4431],{"class":91,"data-line":92,"line":92},[89,4425,1407],{"class":95},[89,4427,4428],{"class":99}," apply",[89,4430,631],{"class":141},[89,4432,4433],{"class":99}," fluent-bit.yaml\n",[89,4435,4436,4438,4440,4442,4445,4448],{"class":91,"data-line":148,"line":148},[89,4437,1407],{"class":95},[89,4439,1410],{"class":141},[89,4441,1413],{"class":99},[89,4443,4444],{"class":99}," rollout",[89,4446,4447],{"class":99}," status",[89,4449,4450],{"class":99}," daemonset\u002Ffluent-bit\n",[89,4452,4453,4455,4457,4459,4462,4465,4468],{"class":91,"data-line":160,"line":160},[89,4454,1407],{"class":95},[89,4456,1410],{"class":141},[89,4458,1413],{"class":99},[89,4460,4461],{"class":99}," get",[89,4463,4464],{"class":99}," pods",[89,4466,4467],{"class":141}," -o",[89,4469,4470],{"class":99}," wide\n",[89,4472,4473,4475,4477,4479,4481,4484],{"class":91,"data-line":235,"line":235},[89,4474,1407],{"class":95},[89,4476,1410],{"class":141},[89,4478,1413],{"class":99},[89,4480,628],{"class":99},[89,4482,4483],{"class":99}," daemonset\u002Ffluent-bit",[89,4485,634],{"class":141},[10,4487,4488],{},"DaemonSet 正常情况下会在每个可调度节点上运行一个 Pod。如果节点数和 Fluent Bit Pod 数量不一致，先检查污点、节点选择器和资源限制。",[179,4490,4492],{"id":4491},"elasticsearch-在-kubernetes-节点宿主机上时","Elasticsearch 在 Kubernetes 节点宿主机上时",[10,4494,4495],{},"如果 Elasticsearch 运行在每个节点都能访问的固定内网地址，直接把该地址写入 Secret 即可。只有 Elasticsearch 恰好运行在 Kubernetes 节点宿主机、且容器网络无法访问宿主机地址时，才考虑为 Fluent Bit 添加：",[32,4497,4499],{"className":192,"code":4498,"language":194,"meta":38,"style":38},"hostNetwork: true\ndnsPolicy: ClusterFirstWithHostNet\n",[14,4500,4501,4510],{"__ignoreMap":38},[89,4502,4503,4506,4508],{"class":91,"data-line":92,"line":92},[89,4504,4505],{"class":201},"hostNetwork",[89,4507,229],{"class":205},[89,4509,553],{"class":141},[89,4511,4512,4515,4517],{"class":91,"data-line":148,"line":148},[89,4513,4514],{"class":201},"dnsPolicy",[89,4516,229],{"class":205},[89,4518,4519],{"class":99},"ClusterFirstWithHostNet\n",[10,4521,4522,4524],{},[14,4523,4505],{"code":4505}," 会扩大容器网络权限和端口冲突范围，不应作为默认配置。更推荐让 Elasticsearch 使用稳定的内网 IP、DNS 名称或 Kubernetes Service。",[28,4526,4527],{"id":4527},"验证日志链路",[10,4529,4530],{},"先启动一个持续输出日志的测试 Pod：",[32,4532,4534],{"className":83,"code":4533,"language":85,"meta":38,"style":38},"kubectl run log-demo \\\n --image=busybox:1.36 \\\n --restart=Never \\\n -- \u002Fbin\u002Fsh -c 'i=0; while true; do i=$((i+1)); echo \"{\\\"level\\\":\\\"info\\\",\\\"message\\\":\\\"log demo\\\",\\\"sequence\\\":$i}\"; sleep 5; done'\n",[14,4535,4536,4548,4557,4566],{"__ignoreMap":38},[89,4537,4538,4540,4543,4546],{"class":91,"data-line":92,"line":92},[89,4539,1407],{"class":95},[89,4541,4542],{"class":99}," run",[89,4544,4545],{"class":99}," log-demo",[89,4547,660],{"class":141},[89,4549,4550,4552,4555],{"class":91,"data-line":148,"line":148},[89,4551,212],{"class":211},[89,4553,4554],{"class":141},"--image=busybox:1.36",[89,4556,660],{"class":141},[89,4558,4559,4561,4564],{"class":91,"data-line":160,"line":160},[89,4560,212],{"class":211},[89,4562,4563],{"class":141},"--restart=Never",[89,4565,660],{"class":141},[89,4567,4568,4570,4573,4576,4579],{"class":91,"data-line":235,"line":235},[89,4569,212],{"class":211},[89,4571,4572],{"class":141},"--",[89,4574,4575],{"class":99}," \u002Fbin\u002Fsh",[89,4577,4578],{"class":141}," -c",[89,4580,4581],{"class":99}," 'i=0; while true; do i=$((i+1)); echo \"{\\\"level\\\":\\\"info\\\",\\\"message\\\":\\\"log demo\\\",\\\"sequence\\\":$i}\"; sleep 5; done'\n",[10,4583,4584],{},"确认 Elasticsearch 已创建索引：",[32,4586,4588],{"className":83,"code":4587,"language":85,"meta":38,"style":38},"curl -u 'elastic:\u003CELASTIC_ADMIN_PASSWORD>' \\\n 'http:\u002F\u002F\u003CELK_SERVER_IP>:9200\u002F_cat\u002Findices\u002Fk8s-logs-*?v'\n",[14,4589,4590,4600],{"__ignoreMap":38},[89,4591,4592,4594,4596,4598],{"class":91,"data-line":92,"line":92},[89,4593,651],{"class":95},[89,4595,654],{"class":141},[89,4597,773],{"class":99},[89,4599,660],{"class":141},[89,4601,4602,4604],{"class":91,"data-line":148,"line":148},[89,4603,212],{"class":211},[89,4605,4606],{"class":99},"'http:\u002F\u002F\u003CELK_SERVER_IP>:9200\u002F_cat\u002Findices\u002Fk8s-logs-*?v'\n",[10,4608,4609],{},"再查询几条记录：",[32,4611,4613],{"className":83,"code":4612,"language":85,"meta":38,"style":38},"curl -u 'elastic:\u003CELASTIC_ADMIN_PASSWORD>' \\\n -H 'Content-Type: application\u002Fjson' \\\n 'http:\u002F\u002F\u003CELK_SERVER_IP>:9200\u002Fk8s-logs-*\u002F_search?pretty' \\\n -d '{\n \"size\": 3,\n \"sort\": [{\"@timestamp\": \"desc\"}],\n \"query\": {\n \"match\": {\"kubernetes.pod_name\": \"log-demo\"}\n }\n }'\n",[14,4614,4615,4625,4635,4644,4652,4659,4666,4673,4682,4689],{"__ignoreMap":38},[89,4616,4617,4619,4621,4623],{"class":91,"data-line":92,"line":92},[89,4618,651],{"class":95},[89,4620,654],{"class":141},[89,4622,773],{"class":99},[89,4624,660],{"class":141},[89,4626,4627,4629,4631,4633],{"class":91,"data-line":148,"line":148},[89,4628,212],{"class":211},[89,4630,782],{"class":141},[89,4632,785],{"class":99},[89,4634,660],{"class":141},[89,4636,4637,4639,4642],{"class":91,"data-line":160,"line":160},[89,4638,212],{"class":211},[89,4640,4641],{"class":99},"'http:\u002F\u002F\u003CELK_SERVER_IP>:9200\u002Fk8s-logs-*\u002F_search?pretty'",[89,4643,660],{"class":141},[89,4645,4646,4648,4650],{"class":91,"data-line":235,"line":235},[89,4647,212],{"class":211},[89,4649,809],{"class":141},[89,4651,812],{"class":99},[89,4653,4654,4656],{"class":91,"data-line":250,"line":250},[89,4655,817],{"class":211},[89,4657,4658],{"class":99},"\"size\": 3,\n",[89,4660,4661,4663],{"class":91,"data-line":265,"line":265},[89,4662,817],{"class":211},[89,4664,4665],{"class":99},"\"sort\": [{\"@timestamp\": \"desc\"}],\n",[89,4667,4668,4670],{"class":91,"data-line":277,"line":277},[89,4669,817],{"class":211},[89,4671,4672],{"class":99},"\"query\": {\n",[89,4674,4675,4677,4679],{"class":91,"data-line":292,"line":292},[89,4676,817],{"class":211},[89,4678,212],{"class":211},[89,4680,4681],{"class":99},"\"match\": {\"kubernetes.pod_name\": \"log-demo\"}\n",[89,4683,4684,4686],{"class":91,"data-line":306,"line":306},[89,4685,817],{"class":211},[89,4687,4688],{"class":99},"}\n",[89,4690,4691,4693],{"class":91,"data-line":320,"line":320},[89,4692,212],{"class":211},[89,4694,859],{"class":99},[10,4696,4697,4698,4702],{},"在 Kibana 中进入 ",[4699,4700,4701],"strong",{},"Stack Management → Data Views","，创建数据视图：",[32,4704,4707],{"className":4705,"code":4706,"language":37,"meta":38},[35],"k8s-logs-*\n",[14,4708,4706],{"__ignoreMap":38},[10,4710,4711,4712,4715],{},"时间字段选择 ",[14,4713,4714],{"code":4714},"@timestamp","，随后就可以在 Discover 中按照以下字段筛选：",[48,4717,4718,4723,4728,4733,4738],{},[51,4719,4720],{},[14,4721,4722],{"code":4722},"kubernetes.namespace_name",[51,4724,4725],{},[14,4726,4727],{"code":4727},"kubernetes.pod_name",[51,4729,4730],{},[14,4731,4732],{"code":4732},"kubernetes.container_name",[51,4734,4735],{},[14,4736,4737],{"code":4737},"kubernetes.labels.*",[51,4739,4740,4743],{},[14,4741,4742],{"code":4742},"log"," 或合并后的 JSON 字段",[10,4745,4746],{},"验证完成后删除测试 Pod：",[32,4748,4750],{"className":83,"code":4749,"language":85,"meta":38,"style":38},"kubectl delete pod log-demo\n",[14,4751,4752],{"__ignoreMap":38},[89,4753,4754,4756,4759,4762],{"class":91,"data-line":92,"line":92},[89,4755,1407],{"class":95},[89,4757,4758],{"class":99}," delete",[89,4760,4761],{"class":99}," pod",[89,4763,4764],{"class":99}," log-demo\n",[28,4766,4767],{"id":4767},"关键配置说明",[179,4769,4771],{"id":4770},"db-不是日志数据库","DB 不是日志数据库",[10,4773,4774,4775,4778],{},"Tail 插件的 ",[14,4776,4777],{"code":4777},"DB"," 文件记录每个日志文件已经读取到的偏移量。Fluent Bit 重启后会根据偏移量继续读取，减少重复采集或漏采。这个文件必须挂载到持久目录，不能只保存在容器临时文件系统中。",[179,4780,4782],{"id":4781},"mem_buf_limit-与磁盘缓冲","Mem_Buf_Limit 与磁盘缓冲",[10,4784,4785,4786,4789,4790,4793],{},"当 Elasticsearch 短暂不可用时，日志会积压。",[14,4787,4788],{"code":4788},"Mem_Buf_Limit"," 限制输入插件占用的内存，",[14,4791,4792],{"code":4792},"storage.type filesystem"," 则允许数据转移到磁盘缓冲。它们能提高短时故障的容忍度，但磁盘空间仍然有限，长期中断最终还是可能丢数据，因此需要监控积压量与磁盘使用率。",[179,4795,4797],{"id":4796},"merge_log-的作用","Merge_Log 的作用",[10,4799,4800,4801,4804,4805,4808],{},"应用输出 JSON 字符串时，Kubernetes filter 可以把 JSON 内容合并到日志记录中。这样在 Kibana 中能够直接按 ",[14,4802,4803],{"code":4803},"level","、",[14,4806,4807],{"code":4807},"trace_id"," 等字段查询，而不是对整段字符串做全文搜索。",[10,4810,4811],{},"业务日志最好保持“一行一条 JSON”，例如：",[32,4813,4817],{"className":4814,"code":4815,"language":4816,"meta":38,"style":38},"language-json shiki shiki-themes github-light github-dark","{\"level\":\"info\",\"message\":\"order created\",\"trace_id\":\"demo-trace-id\",\"order_id\":\"demo-order-id\"}\n","json",[14,4818,4819],{"__ignoreMap":38},[89,4820,4821,4824,4827,4830,4833,4836,4839,4841,4844,4846,4849,4851,4854,4856,4859,4861,4864],{"class":91,"data-line":92,"line":92},[89,4822,4823],{"class":1624},"{",[89,4825,4826],{"class":141},"\"level\"",[89,4828,4829],{"class":205},":",[89,4831,4832],{"class":99},"\"info\"",[89,4834,4835],{"class":205},",",[89,4837,4838],{"class":141},"\"message\"",[89,4840,4829],{"class":205},[89,4842,4843],{"class":99},"\"order created\"",[89,4845,4835],{"class":205},[89,4847,4848],{"class":141},"\"trace_id\"",[89,4850,4829],{"class":205},[89,4852,4853],{"class":99},"\"demo-trace-id\"",[89,4855,4835],{"class":205},[89,4857,4858],{"class":141},"\"order_id\"",[89,4860,4829],{"class":205},[89,4862,4863],{"class":99},"\"demo-order-id\"",[89,4865,4688],{"class":1624},[10,4867,4868,4869,4872],{},"堆栈信息等多行日志由 ",[14,4870,4871],{"code":4871},"multiline.parser docker, cri"," 负责合并。应用自行输出非标准多行格式时，需要额外定义 multiline parser。",[179,4874,4876],{"id":4875},"retry_limit-false-不是无限可靠","Retry_Limit False 不是无限可靠",[10,4878,4879,4882],{},[14,4880,4881],{"code":4881},"Retry_Limit False"," 表示输出插件持续重试，但它不代表日志永远不会丢失。节点重装、缓冲目录损坏、磁盘写满和 Elasticsearch 长时间不可用都可能造成数据损失。重要审计日志还应考虑消息队列、对象存储归档或其他可靠传输方案。",[28,4884,4885],{"id":4885},"常见问题排查",[179,4887,4889],{"id":4888},"fluent-bit-没有采集到任何文件","Fluent Bit 没有采集到任何文件",[10,4891,4892],{},"进入 Pod 检查挂载目录：",[32,4894,4896],{"className":83,"code":4895,"language":85,"meta":38,"style":38},"kubectl -n default exec -it daemonset\u002Ffluent-bit -- \\\n sh -c 'ls -l \u002Fvar\u002Flog\u002Fcontainers | head'\n",[14,4897,4898,4917],{"__ignoreMap":38},[89,4899,4900,4902,4904,4906,4908,4910,4912,4915],{"class":91,"data-line":92,"line":92},[89,4901,1407],{"class":95},[89,4903,1410],{"class":141},[89,4905,1413],{"class":99},[89,4907,686],{"class":99},[89,4909,689],{"class":141},[89,4911,4483],{"class":99},[89,4913,4914],{"class":141}," --",[89,4916,660],{"class":141},[89,4918,4919,4921,4924,4926],{"class":91,"data-line":148,"line":148},[89,4920,212],{"class":211},[89,4922,4923],{"class":99},"sh",[89,4925,4578],{"class":141},[89,4927,4928],{"class":99}," 'ls -l \u002Fvar\u002Flog\u002Fcontainers | head'\n",[10,4930,4931,4932,4935,4936,4939],{},"如果目录为空，需要确认节点运行时的实际日志路径。有些发行版还需要挂载 ",[14,4933,4934],{"code":4934},"\u002Fvar\u002Flib\u002Fdocker\u002Fcontainers"," 或 ",[14,4937,4938],{"code":4938},"\u002Fvar\u002Flog\u002Fpods","，具体取决于容器运行时和符号链接目标。",[179,4941,4943],{"id":4942},"kubernetes-元数据为空","Kubernetes 元数据为空",[10,4945,4946],{},"依次检查 ServiceAccount、RBAC 和集群 API 连通性：",[32,4948,4950],{"className":83,"code":4949,"language":85,"meta":38,"style":38},"kubectl auth can-i list pods \\\n --as=system:serviceaccount:default:fluent-bit --all-namespaces\n\nkubectl auth can-i get namespaces \\\n --as=system:serviceaccount:default:fluent-bit\n",[14,4951,4952,4969,4979,4983,4998],{"__ignoreMap":38},[89,4953,4954,4956,4959,4962,4965,4967],{"class":91,"data-line":92,"line":92},[89,4955,1407],{"class":95},[89,4957,4958],{"class":99}," auth",[89,4960,4961],{"class":99}," can-i",[89,4963,4964],{"class":99}," list",[89,4966,4464],{"class":99},[89,4968,660],{"class":141},[89,4970,4971,4973,4976],{"class":91,"data-line":148,"line":148},[89,4972,212],{"class":211},[89,4974,4975],{"class":141},"--as=system:serviceaccount:default:fluent-bit",[89,4977,4978],{"class":141}," --all-namespaces\n",[89,4980,4981],{"class":91,"data-line":160,"line":160},[89,4982,521],{"emptyLinePlaceholder":520},[89,4984,4985,4987,4989,4991,4993,4996],{"class":91,"data-line":235,"line":235},[89,4986,1407],{"class":95},[89,4988,4958],{"class":99},[89,4990,4961],{"class":99},[89,4992,4461],{"class":99},[89,4994,4995],{"class":99}," namespaces",[89,4997,660],{"class":141},[89,4999,5000,5002],{"class":91,"data-line":250,"line":250},[89,5001,212],{"class":211},[89,5003,5004],{"class":141},"--as=system:serviceaccount:default:fluent-bit\n",[10,5006,5007,5008,5011,5012,5015],{},"同时确认 ",[14,5009,5010],{"code":5010},"Tag"," 与 ",[14,5013,5014],{"code":5014},"Kube_Tag_Prefix"," 能对应容器日志文件名。前缀错误时，filter 无法从 tag 中解析 Pod、Namespace 和容器名称。",[179,5017,5019],{"id":5018},"elasticsearch-返回-401","Elasticsearch 返回 401",[10,5021,5022],{},"通常是用户名或密码不一致。先验证 Secret 中的内容是否正确，再使用同一账户直接请求 Elasticsearch：",[32,5024,5026],{"className":83,"code":5025,"language":85,"meta":38,"style":38},"curl -u 'fluent_bit:\u003CFLUENT_BIT_STRONG_PASSWORD>' \\\n http:\u002F\u002F\u003CELK_SERVER_IP>:9200\u002F_security\u002F_authenticate?pretty\n",[14,5027,5028,5038],{"__ignoreMap":38},[89,5029,5030,5032,5034,5036],{"class":91,"data-line":92,"line":92},[89,5031,651],{"class":95},[89,5033,654],{"class":141},[89,5035,953],{"class":99},[89,5037,660],{"class":141},[89,5039,5040,5042,5045,5047,5050,5053,5056],{"class":91,"data-line":148,"line":148},[89,5041,212],{"class":211},[89,5043,5044],{"class":99},"http:\u002F\u002F",[89,5046,584],{"class":580},[89,5048,5049],{"class":99},"ELK_SERVER_I",[89,5051,5052],{"class":205},"P",[89,5054,5055],{"class":580},">",[89,5057,5058],{"class":99},":9200\u002F_security\u002F_authenticate?pretty\n",[10,5060,5061],{},"更新 Secret 后，已有 Pod 不会自动刷新环境变量，需要重启 DaemonSet：",[32,5063,5065],{"className":83,"code":5064,"language":85,"meta":38,"style":38},"kubectl -n default rollout restart daemonset\u002Ffluent-bit\n",[14,5066,5067],{"__ignoreMap":38},[89,5068,5069,5071,5073,5075,5077,5080],{"class":91,"data-line":92,"line":92},[89,5070,1407],{"class":95},[89,5072,1410],{"class":141},[89,5074,1413],{"class":99},[89,5076,4444],{"class":99},[89,5078,5079],{"class":99}," restart",[89,5081,4450],{"class":99},[179,5083,5085],{"id":5084},"elasticsearch-返回-403","Elasticsearch 返回 403",[10,5087,5088,5089,5092],{},"认证已经成功，但用户缺少索引权限。查看 Fluent Bit 日志中的目标索引名，确认角色的 ",[14,5090,5091],{"code":5091},"names"," 范围覆盖该索引，并具备创建索引和写入文档的权限。",[179,5094,5096],{"id":5095},"kibana-报-unable-to-retrieve-version-information","Kibana 报 Unable to retrieve version information",[10,5098,5099],{},"重点检查以下内容：",[5101,5102,5103,5109,5114,5119],"ol",{},[51,5104,5105,5106,5108],{},"Kibana 容器能否解析 ",[14,5107,215],{"code":215}," 容器名。",[51,5110,5111,5112,986],{},"两个容器是否加入同一个 ",[14,5113,536],{"code":536},[51,5115,5116,5118],{},[14,5117,732],{"code":732}," 密码是否已重置且与 Compose 环境变量一致。",[51,5120,5121],{},"Elasticsearch 是否已经完成启动，而不是只看容器处于 Running。",[32,5123,5125],{"className":83,"code":5124,"language":85,"meta":38,"style":38},"docker exec kibana \\\n curl -sS http:\u002F\u002Felasticsearch:9200\n\ndocker compose logs --tail=200 elasticsearch kibana\n",[14,5126,5127,5138,5150,5154],{"__ignoreMap":38},[89,5128,5129,5131,5133,5136],{"class":91,"data-line":92,"line":92},[89,5130,96],{"class":95},[89,5132,686],{"class":99},[89,5134,5135],{"class":99}," kibana",[89,5137,660],{"class":141},[89,5139,5140,5142,5144,5147],{"class":91,"data-line":148,"line":148},[89,5141,212],{"class":211},[89,5143,651],{"class":99},[89,5145,5146],{"class":141}," -sS",[89,5148,5149],{"class":99}," http:\u002F\u002Felasticsearch:9200\n",[89,5151,5152],{"class":91,"data-line":160,"line":160},[89,5153,521],{"emptyLinePlaceholder":520},[89,5155,5156,5158,5160,5162,5165,5167],{"class":91,"data-line":235,"line":235},[89,5157,96],{"class":95},[89,5159,613],{"class":99},[89,5161,628],{"class":99},[89,5163,5164],{"class":141}," --tail=200",[89,5166,692],{"class":99},[89,5168,5169],{"class":99}," kibana\n",[179,5171,5173],{"id":5172},"出现-mapper_parsing_exception","出现 mapper_parsing_exception",[10,5175,5176,5177,5180],{},"同一个字段在不同日志里出现了不同类型，例如一条日志的 ",[14,5178,5179],{"code":5179},"status"," 是数字，另一条却是字符串。应统一应用日志结构，并通过索引模板固定关键字段类型。不要只通过删除索引来临时解决，否则新数据仍会再次触发冲突。",[28,5182,5183],{"id":5183},"上线前还需要做什么",[10,5185,5186],{},"本文配置适合单机或中小规模内网环境。准备长期运行时，至少还要补齐：",[48,5188,5189,5195,5198,5201,5204,5207,5210],{},[51,5190,5191,5192,5194],{},"为 Elasticsearch 启用 TLS，不要把 ",[14,5193,66],{"code":66}," 直接暴露到公网。",[51,5196,5197],{},"使用防火墙或安全组，只允许 Kubernetes 节点访问 Elasticsearch。",[51,5199,5200],{},"配置 ILM（索引生命周期管理），自动滚动和删除过期日志。",[51,5202,5203],{},"为 Elasticsearch 数据卷做容量监控与备份。",[51,5205,5206],{},"在 Kibana 中按团队划分空间和角色，避免所有人共用超级用户。",[51,5208,5209],{},"对手机号、身份证、Token、Cookie 等敏感字段在应用输出前脱敏；采集端过滤只能作为补充，不能代替源头治理。",[51,5211,5212],{},"为 Fluent Bit 的重试、丢弃记录、缓冲区和输出错误建立告警。",[10,5214,5215],{},"至此，一条可检索、带 Kubernetes 元数据并具备基础缓冲能力的日志链路就搭建完成了。后续日志量增长时，可以继续演进为 Elasticsearch 集群、数据流与 ILM，或者在 Fluent Bit 和 Elasticsearch 之间增加 Kafka 作为削峰与持久缓冲层。",[28,5217,5218],{"id":5218},"参考资料说明",[48,5220,5221,5231,5244,5256,5264,5277,5290],{},[51,5222,5223,5230],{},[5224,5225,5229],"a",{"href":5226,"rel":5227},"https:\u002F\u002Fdocs.fluentbit.io\u002Fmanual\u002Finstallation\u002Fkubernetes",[5228],"nofollow","在 Kubernetes 中部署 Fluent Bit","：用于理解为什么日志采集器通常以 DaemonSet 运行，以及需要挂载哪些节点目录。",[51,5232,5233,5238,5239,4804,5241,5243],{},[5224,5234,5237],{"href":5235,"rel":5236},"https:\u002F\u002Fdocs.fluentbit.io\u002Fmanual\u002Fdata-pipeline\u002Finputs\u002Ftail",[5228],"Tail 输入插件","：重点参考 ",[14,5240,4777],{"code":4777},[14,5242,4788],{"code":4788},"、文件轮转和长日志处理配置。",[51,5245,5246,5251,5252,5255],{},[5224,5247,5250],{"href":5248,"rel":5249},"https:\u002F\u002Fdocs.fluentbit.io\u002Fmanual\u002Fdata-pipeline\u002Ffilters\u002Fkubernetes",[5228],"Kubernetes Filter","：说明 Pod 元数据补充、",[14,5253,5254],{"code":5254},"Merge_Log","、标签与注解处理方式。",[51,5257,5258,5263],{},[5224,5259,5262],{"href":5260,"rel":5261},"https:\u002F\u002Fdocs.fluentbit.io\u002Fmanual\u002Fdata-pipeline\u002Foutputs\u002Felasticsearch",[5228],"Elasticsearch 输出插件","：说明认证、索引命名、重试和 Elasticsearch 8 类型兼容配置。",[51,5265,5266,5011,5271,5276],{},[5224,5267,5270],{"href":5268,"rel":5269},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fdeploy-manage\u002Fdeploy\u002Fself-managed\u002Finstall-elasticsearch-docker-basic",[5228],"使用 Docker 启动 Elasticsearch",[5224,5272,5275],{"href":5273,"rel":5274},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fdeploy-manage\u002Fdeploy\u002Fself-managed\u002Finstall-kibana-with-docker",[5228],"使用 Docker 部署 Kibana","：对应本文拆分后的两套 Compose 部署。",[51,5278,5279,5284,5285,5011,5287,5289],{},[5224,5280,5283],{"href":5281,"rel":5282},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fdeploy-manage\u002Fusers-roles\u002Fcluster-or-deployment-auth\u002Fbuilt-in-users",[5228],"Elasticsearch 内置用户","：解释 ",[14,5286,563],{"code":563},[14,5288,732],{"code":732}," 的职责区别。",[51,5291,5292,5297,5298,5301],{},[5224,5293,5296],{"href":5294,"rel":5295},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fapi\u002Fdoc\u002Felasticsearch\u002Foperation\u002Foperation-security-put-user",[5228],"创建或更新用户 API","：对应在 Elasticsearch 容器中创建 ",[14,5299,5300],{"code":5300},"fluent_bit"," 写入用户的步骤。",[5303,5304,5305],"style",{},"html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .s9eBZ, html code.shiki .s9eBZ{--shiki-default:#22863A;--shiki-dark:#85E89D}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sSDpw, html code.shiki .sSDpw{--shiki-default:#005cc5;--shiki-dark:#79b8ff}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .s4XuR, html code.shiki .s4XuR{--shiki-default:#E36209;--shiki-dark:#FFAB70}",{"title":38,"searchDepth":235,"depth":235,"links":5307},[5308,5309,5310,5316,5317,5320,5321,5327,5335,5336],{"id":30,"depth":148,"text":30},{"id":46,"depth":148,"text":46},{"id":76,"depth":148,"text":77,"children":5311},[5312,5313,5314,5315],{"id":181,"depth":160,"text":182},{"id":670,"depth":160,"text":671},{"id":977,"depth":160,"text":978},{"id":989,"depth":160,"text":990},{"id":1393,"depth":148,"text":1394},{"id":1466,"depth":148,"text":1467,"children":5318},[5319],{"id":4491,"depth":160,"text":4492},{"id":4527,"depth":148,"text":4527},{"id":4767,"depth":148,"text":4767,"children":5322},[5323,5324,5325,5326],{"id":4770,"depth":160,"text":4771},{"id":4781,"depth":160,"text":4782},{"id":4796,"depth":160,"text":4797},{"id":4875,"depth":160,"text":4876},{"id":4885,"depth":148,"text":4885,"children":5328},[5329,5330,5331,5332,5333,5334],{"id":4888,"depth":160,"text":4889},{"id":4942,"depth":160,"text":4943},{"id":5018,"depth":160,"text":5019},{"id":5084,"depth":160,"text":5085},{"id":5095,"depth":160,"text":5096},{"id":5172,"depth":160,"text":5173},{"id":5183,"depth":148,"text":5183},{"id":5218,"depth":148,"text":5218},[5338],"云原生","2026-07-29","从日志链路设计开始，完整介绍 Elasticsearch、Kibana 与 Fluent Bit 的部署、鉴权、持久化、Kubernetes 元数据补充、索引验证及常见故障排查。",false,"md",null,{"slots":5345},{},"\u002F2026\u002F07\u002Fk8s-logs-to-elk-with-fluent-bit",{"text":5348,"minutes":5349,"time":5350,"words":5351},"17 min read",16.845,1010700,3369,[5353,5355,5357,5359,5361,5363,5365,5367],{"title":5354,"link":5226},"Fluent Bit 官方文档：在 Kubernetes 中部署",{"title":5356,"link":5235},"Fluent Bit 官方文档：Tail 输入、游标与缓冲配置",{"title":5358,"link":5248},"Fluent Bit 官方文档：补充 Kubernetes 元数据",{"title":5360,"link":5260},"Fluent Bit 官方文档：写入 Elasticsearch",{"title":5362,"link":5268},"Elastic 官方文档：使用 Docker 启动单节点 Elasticsearch",{"title":5364,"link":5273},"Elastic 官方文档：使用 Docker 部署 Kibana",{"title":5366,"link":5281},"Elastic 官方文档：内置用户与 kibana_system",{"title":5368,"link":5294},"Elasticsearch API：创建或更新用户",{"title":5,"description":5340},{"loc":5346},"posts\u002F2026\u002F07\u002Fk8s-logs-to-elk-with-fluent-bit",[5373,5374,5375,5376,5377],"Kubernetes","Fluent Bit","Elasticsearch","Kibana","日志","tech","K3HV7zEba0Cg9uMOtyxB81G1TPSOYErtOu4BhK52Bqo",[5381,5386],{"title":5382,"path":5383,"stem":5384,"date":5385,"type":5378,"children":-1},"本地 kubectl 管理远程","\u002F2026\u002F06\u002Flocal-kubectl-manage-remote","posts\u002F2026\u002F06\u002Flocal-kubectl-manage-remote","2026-06-19",{"title":5387,"path":5388,"stem":5389,"date":5390,"type":5378,"children":-1},"macOS 搭建 Flutter Android 与 iOS 开发环境","\u002F2026\u002F08\u002Fflutter-macos-environment-setup","posts\u002F2026\u002F08\u002Fflutter-macos-environment-setup","2026-08-02",1786555052636]