# 安裝 Logging operator（Fluentd & fluentbit）on K8s

## 安裝

### 1. 安裝 logging-operator

$ helm upgrade --install --wait --create-namespace --namespace logging logging-operator oci://ghcr.io/kube-logging/helm-charts/logging-operator

$ kubectl -n logging get all
NAME                                    READY   STATUS    RESTARTS   AGE
pod/logging-operator-7dcd45979c-t25sp   1/1     Running   0          3m55s

NAME                       TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)    AGE
service/logging-operator   ClusterIP   None         <none>        8080/TCP   3m55s

NAME                               READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/logging-operator   1/1     1            1           3m55s

NAME                                          DESIRED   CURRENT   READY   AGE
replicaset.apps/logging-operator-7dcd45979c   1         1         1       3m55s

### 2. 建立 Fluentd

部署 Fluentd 作為中央 log 聚合器和轉發器。

$ kubectl --namespace logging apply -f - <<"EOF"
apiVersion: logging.banzaicloud.io/v1beta1
kind: Logging
metadata:
  name: logging
spec:
  controlNamespace: logging
  fluentd:
    disablePvc: true
EOF

$ kubectl -n logging get pod
NAME                                   READY   STATUS      RESTARTS   AGE
logging-fluentd-0                      2/2     Running     0          84s
logging-fluentd-configcheck-ac2d4553   0/1     Completed   0          2m21s
logging-operator-7dcd45979c-t25sp      1/1     Running     0          9m8s

### 3. 建立 Fluentbit
部署 Fluentbit 負責收集所有 container 的 log。

$ kubectl --namespace logging apply -f - <<"EOF"
apiVersion: logging.banzaicloud.io/v1beta1
kind: FluentbitAgent
metadata:
    name: logging
spec: {}
EOF

$ kubectl -n logging get pod
NAME                                   READY   STATUS      RESTARTS   AGE
logging-fluentbit-fcfcg                1/1     Running     0          63s
logging-fluentbit-gd6lj                1/1     Running     0          63s
logging-fluentbit-qsq2x                1/1     Running     0          63s
logging-fluentbit-rncwv                1/1     Running     0          63s
logging-fluentbit-wslrj                1/1     Running     0          63s
logging-fluentd-0                      2/2     Running     0          2m59s
logging-fluentd-configcheck-ac2d4553   0/1     Completed   0          3m56s
logging-operator-7dcd45979c-t25sp      1/1     Running     0          10m

## 測試

* Flow: 根據指定收集帶有 `logging-test: 'true'` 這個標籤的 pod 的 log。並且會把 log 送往指定的 `localOutputRefs`。
* Output: 是指定要將收集到的 log 送去給哪個 backend，以下範例是送往 `logging-fluentd-0` pod 自己的肚子。

$ kubectl apply -f - <<"EOF"
apiVersion: logging.banzaicloud.io/v1beta1
kind: Output
metadata:
 name: test-output
 namespace: default
spec:
 file:
    path: /tmp/logs/${tag}/%Y/%m/%d/%H.%M
    buffer:
      timekey: 1m
      timekey_wait: 10s
      timekey_use_utc: true
---
apiVersion: logging.banzaicloud.io/v1beta1
kind: Flow
metadata:
  name: test-flow
  namespace: default
spec:
  localOutputRefs:
    - test-output
  match:
    - select:
        labels:
          logging-test: 'true'
---
apiVersion: v1
kind: Pod
metadata:
  name: test-logging-pod
  namespace: default
  labels:
    logging-test: "true"
spec:
  containers:
  - name: sak
    image: rancherlabs/swiss-army-knife:latest
    command: ["/bin/sh"]
    args:
    - -c
    - |
      i=0;
      while true;
      do
        echo "$(date) INFO $i";  
        i=$((i+1));sleep 1;
      done
EOF

* fluentbit 會將收集到 log 丟到 logging-fluentd-0 的 `/buffers` 目錄區，然後 fluentd 會再根據 output 將 log 丟到指定 backend。
* 可以在 fluentd 的 `/tmp/logs/` 看到 log 是因為我們在 output 指定的。

$ kubectl -n logging exec -it logging-fluentd-0 -- sh

/ $ ls -l /buffers/
total 16
-rw-r--r--    1 fluent   fluent        9282 Sep  5 02:34 flow:default:test-flow:output:default:test-output.b63e04aeb14633fd372e5977db9841091.buffer
-rw-r--r--    1 fluent   fluent         207 Sep  5 02:34 flow:default:test-flow:output:default:test-output.b63e04aeb14633fd372e5977db9841091.buffer.meta


/ $ ls -lah /tmp/logs/
total 12K
drwxr-xr-x    3 fluent   fluent      4.0K Sep  5 02:35 .
drwxrwxrwt    1 root     root        4.0K Sep  5 02:35 ..
drwxr-xr-x    3 fluent   fluent      4.0K Sep  5 02:35 kubernetes.var.log.containers.test-logging-pod_default_sak-d60d70b0f3490bda714ab6d030015912cac245341f1f77690854af61365c4697.log

* 環境清除

$ kubectl delete output test-output;kubectl delete flow test-flow;kubectl delete pod test-logging-pod

## 參考

https://kube-logging.dev/docs/install/