Elasticsearch 用于存储数据，Logstash 用于处理日志，Kibana 用于可视化数据。以下是一个使用 YAML 文件部署ELK Stack 的基本示例。
1 部署 pv和pvc
apiVersion: v1
kind: PersistentVolume
metadata:name: elasticsearch-pvlabels:type: local
spec:storageClassName: manualcapacity:storage: 10GiaccessModes:- ReadWriteOncehostPath:path: "/mnt/data"kubectl apply -f elasticsearch-pv.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:name: elasticsearch-pvc
spec:storageClassName: manualaccessModes:- ReadWriteOnceresources:requests:storage: 10Giselector:matchLabels:type: localkubectl apply -f elasticsearch-pvc.yaml
2 部署ELK
部署 Elasticsearch
mkdir -p /usr/share/elasticsearch/data
# elasticsearch-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:name: elasticsearch
spec:replicas: 1selector:matchLabels:app: elasticsearchtemplate:metadata:labels:app: elasticsearchspec:initContainers:- name: set-dir-ownerimage: busyboxcommand: ["sh", "-c", "chown -R 1000:1000 /usr/share/elasticsearch/data"]volumeMounts:- name: datamountPath: /usr/share/elasticsearch/datacontainers:- name: elasticsearchimage: docker.elastic.co/elasticsearch/elasticsearch:7.10.1env:- name: "discovery.type"value: "single-node"ports:- containerPort: 9200name: rest-api- containerPort: 9300name: inter-nodevolumeMounts:- name: datamountPath: /usr/share/elasticsearch/datavolumes:- name: datapersistentVolumeClaim:claimName: elasticsearch-pvckubectl apply -f elasticsearch-deployment.yaml
# elasticsearch-service.yaml
apiVersion: v1
kind: Service
metadata:name: elasticsearch
spec:type: NodePortports:- port: 9200targetPort: 9200nodePort: 30200selector:app: elasticsearchkubectl apply -f elasticsearch-service.yaml
部署 Kibana
# kibana-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:name: kibana
spec:replicas: 1selector:matchLabels:app: kibanatemplate:metadata:labels:app: kibanaspec:containers:- name: kibanaimage: docker.elastic.co/kibana/kibana:7.10.1env:- name: "ELASTICSEARCH_HOSTS"value: "http://elasticsearch:9200"ports:- containerPort: 5601name: kibanakubectl apply -f kibana-deployment.yaml
# kibana-service.yaml
apiVersion: v1
kind: Service
metadata:name: kibana
spec:type: NodePortports:- port: 5601targetPort: 5601nodePort: 30561selector:app: kibanakubectl apply -f kibana-service.yaml
部署 Logstash
# logstash-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:name: logstash
spec:replicas: 1selector:matchLabels:app: logstashtemplate:metadata:labels:app: logstashspec:containers:- name: logstashimage: docker.elastic.co/logstash/logstash:7.10.1env:- name: "ELASTICSEARCH_HOSTS"value: "http://elasticsearch:9200"ports:- containerPort: 5044name: logstashkubectl apply -f logstash-deployment.yaml
3 注释
Service 为这些 Pod 提供了一个固定的、稳定的访问地址
在 elasticsearch-deployment.yaml 中，containerPort: 9200 和 containerPort: 9300 是在每个 Pod 中开放这两个端口，以便 Pod 内的 Elasticsearch 进程可以监听这些端口。
在 elasticsearch-service.yaml 中，port: 9200 和 targetPort: 9200 是定义一个 Service，这个 Service 在 9200 端口监听，并将所有到达这个端口的请求转发到后端 Pod 的 9200 端口。
Kibana 需要通过 Elasticsearch 的 Service 来连接 Elasticsearch，这是因为 Kibana 需要一个稳定的、不变的地址来访问 Elasticsearch，而不是直接连接到某个特定的 Pod。如果没有 Service，Kibana 就需要知道每个 Elasticsearch Pod 的 IP 地址，这在实际操作中是不可行的，因为 Pod 的 IP 地址可能会频繁变化
