Centralizing spring boot logs with ELK stack?

UNIX for Beginners Q & A
1

I've got ELK stack up and running.

image
image1344×683 81 KB

Now, I want a java spring boot application from github which is based on microservices and from it, I will deploy it in multiple nodes. And centralize the logs of it using ELK. But I didn't find much reputed resources about this online. Does anyone here has done it in the past?

This project can change my view point about system administration and I am eager to learn it.

2

You can mount your logging directories outside your containers and then use filebeat on the parent host to feed the logs to Elasticsearch

3

We assume that you have read this Elastic tutorial?

4

yes I read it and other few blogs and configured ELK (elastic search, logstash, kibana). So, now I have also deployed spring boot application on kubernetes(k3s) following this blog.

Now I want to ship its logs.

Unfortunately this wasn't generating any logs.

5

Still any guidance?

6

You already received guidance from @Skrynesaver in their reply:

To achieve persistence, you need to mount files and filesystems as a shared volume, allowing them to be accessible both inside the container and on the host filesystem, as @Skrynesaver suggested.

7

How did you determine that spring boot application is not logging anything when deployed on k8s, isn't kubectl logs .. working or showing anything ?

Kubernetes should log pod traffic by default, and pods (containers inside) should log everything to STDOUT/STDERR

Try deploying some well known k8s service, instead of custom app for first attempts, since those probably have logging set in place.

Take a look at this for core concepts

Pay attention to versions you are using, and components - versions described in docs.

When you figure above out, then it a matter of shipping those logs to external system.

This can be done in multitude of ways.

Use k8s operator or specific deployments which create containers who sole intention is to read and forward logs (via network) generated by your pods, already mentioned in posts.

Keep it (log forwarding) in k8s as container runtime, avoid having 'agents' on compute hosts directly.

Is ELK stack external or internal to kubernetes ?

Hope that helps
Regards
Peasant.

8

ELK is installed independently in different server.

9

filebeat will connect to port 9200 and send the logs to ELK for indexing