configmap.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  namespace: elastic
  labels:
    k8s-app: fluent-bit
data:
  fluent-bit.conf: |
    [SERVICE]
        Flush         5
        Log_Level     debug
        Daemon        off
        Parsers_File  parsers.conf
        HTTP_Server   On
        HTTP_Listen   0.0.0.0
        HTTP_Port     2020
        # Logging 파이프라인
    @INCLUDE input-kubernetes.conf
    @INCLUDE filter-kubernetes.conf
    @INCLUDE output-elasticsearch.conf

  input-kubernetes.conf: |
    [INPUT]
        Name              tail
        Path              /var/log/containers/*_kube-system_*.log
        # Path에서 수집되는 데이터 태깅
        Tag               kube.*
        Read_from_head    true
        Parser            cri
    [INPUT]
        Name              tail
        Tag               shop.*
        Path              /var/log/containers/*_shop_*.log
        Multiline         on
        Read_from_head    true
        Parser_Firstline  multiline_pattern

  filter-kubernetes.conf: |
    [FILTER]
        Name                kubernetes
        # 모든 태그에 대해 kubernetes Filtering 처리. (k8s 메타정보로 Log Enrichment)
        Match               *
        Kube_URL            https://kubernetes.default.svc:443
        Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix     kube.var.log.containers.
        Merge_Log           On
        Merge_Log_Key       log_processed
        K8S-Logging.Parser  On
        K8S-Logging.Exclude Off
    [FILTER]
        Name                  multiline
        Match                 shop.*
        multiline.key_content log
        multiline.parser      java

  output-elasticsearch.conf: |
    [OUTPUT]
        Name            es
        Match           kube.*
        Host            ${FLUENT_ELASTICSEARCH_HOST}
        Port            ${FLUENT_ELASTICSEARCH_PORT}
        # kubernetes Sys 로그의 Index Name 설정
        Index           fluent-k8s
        Type            flb_type
        Logstach_Format On
        Logstach_Prefix fluent-k8s
        Retry_Limit     False
    [OUTPUT]
        Name            es
        Match           shop.*
        Host            ${FLUENT_ELASTICSEARCH_HOST}
        Port            ${FLUENT_ELASTICSEARCH_PORT}
        # shop 네임스페이스 로그의 Index Name 설정
        Index           fluent-shop
        Type            flb_type
        Logstach_Format On
        Logstach_Prefix fluent-shop
        Retry_Limit     False

  parsers.conf: |
    [PARSER]
        Name cri
        Format regex
        Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
        Time_Key    time
        Time_Format %Y-%m-%dT%H:%M:%S.%L%z

    [PARSER]
        Name multiline_pattern
        Format regex
        Regex   ^\[(?<timestamp>[0-9]{2,4}\-[0-9]{1,2}\-[0-9]{1,2} [0-9]{1,2}\:[0-9]{1,2}\:[0-9]{1,2})\] (?<message>.*)
        Time_Key    time
        Time_Format %Y-%m-%