Fluentd sample

fluentd-deployment

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-var-log-pods
  labels:
    type: local
spec:
  storageClassName: local-path
  accessModes:
    - ReadOnlyMany
  capacity:
    storage: 2Gi
  hostPath:
    path: "/var/log/pods"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-var-log-pods
  namespace: monitoring
spec:
  storageClassName: local-path
  accessModes:
    - ReadOnlyMany
  resources:
    requests:
      storage: 2Gi
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: fluentd-config
  namespace: monitoring
  labels:
    k8s-app: fluentd-logging
    version: v1
    kubernetes.io/cluster-service: "true"
data:
  fluent.conf: |
    <source>
      @type tail
      @id in_tail_container_logs
      path "/var/log/pods/default_cron-*/*/*.log"
      pos_file "/tmp/cron_.log.pos"
      read_from_head true
      tag cron
      <parse>
        @type regexp
        expression /^(?<logtime>[^ ]*) .* level=(?<level>[^ ]*) msg="(?<message>[^"]*)"$/ 
        time_key logtime
        time_format %FT%T.%N%:z
      </parse>
    </source>
    
    <match cron>
     @type remote_syslog
     host 172.16.3.10
     port 514
     protocol udp
     severity info
     program "fluentd"
     hostname "k3sserver"
     
     <buffer>
     </buffer>
     
     <format>
      @type single_value
      message_key message
     </format>
    </match>
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: fluentd
  namespace: monitoring
  labels:
    app: fluentd
spec:
  replicas: 1
  selector:
    matchLabels:
      app: fluentd
  template:
    metadata:
      labels:
        app: fluentd
    spec:
      securityContext:
        fsGroup: 0
      volumes:
        - name: varlogpods-pv
          persistentVolumeClaim:
            claimName: pvc-var-log-pods
        - name: fluentd-config
          configMap:
            name: fluentd-config
      containers:
        - name: fluentd
          image: klamber/fluentd-v1.14.0-1.0
          ports:
            - containerPort: 24224
              name: tcp
          volumeMounts:
            - name: fluentd-config
              mountPath: /fluentd/etc/fluent.conf
              subPath: fluent.conf
            - name: varlogpods-pv
              mountPath: /var/log/pods
              readOnly: true