1

I read in kubernetes docs somewhere that kubernetes reads application logs from stdout and stderror in pods. I created a new application and configured it to send logs to a remote splunk hec endpoint (using splunk-logback jars) and at the same time to console. So by default, the console logs in logback should go to System.out, which should then be visible using kubectl logs . But it's not happening in my application.

my logback file:

<?xml version="1.0" encoding="UTF-8"?>

<configuration>

    <Appender name="SPLUNK" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
        <url>${splunk_hec_url}</url>
        <token>${splunk_hec_token}</token>
        <index>${splunk_app_token}</index>
        <disableCertificateValidation>true</disableCertificateValidation>
        <batch_size_bytes>1000000</batch_size_bytes>
        <batch_size_count>${batch_size_count}</batch_size_count>
        <send_mode>sequential</send_mode>

        <layout class="ch.qos.logback.classic.PatternLayout">
            <pattern>%msg</pattern>
        </layout>
    </Appender>

    <Appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%msg</pattern>
        </encoder>
    </Appender>

    <Appender name="ASYNC" class="ch.qos.logback.classic.AsyncAppender">
        <appender-ref ref="STDOUT" />
    </Appender>

    <root level="INFO">
        <appender-ref ref="SPLUNK"/>
        <appender-ref ref="ASYNC"/>
    </root>

</configuration>

I am able to see the logs in splunk and If I login to the container from backend and start my java application, then also I can see the logs on the terminal that time. But if I let the container start by default on it's own, then the logs are only going to splunk and I can't view them using kubectl logs <POD_NAME>

The kubernetes yml file for my logger app:

apiVersion: v1
kind: Pod
metadata:
    name: logging-pod
    labels:
       app: logging-pod
spec:
  containers:
     - name: logging-container
       image: logger-splunk:latest
       command: ["java", "-jar", "logger-splunk-1.0-SNAPSHOT.jar"]
       resources:
          requests:
             cpu: 1
             memory: 1Gi
          limits:
             cpu: 1
             memory: 1Gi
4

2 回答 2

1

根据 Kubenetes文档，默认情况下，所有输出（容器化应用程序写入stdout和stderr）都重定向到 JSON 文件。您可以使用kubectl logs.

让我们通过创建一个在标准输出中输出数字的简单 pod 来测试此功能：

kubectl create -f https://k8s.io/docs/tasks/debug-application-cluster/counter-pod.yaml

反pod.yaml：

apiVersion: v1
kind: Pod
metadata:
  name: counter
spec:
  containers:
  - name: count
    image: busybox
    args: [/bin/sh, -c,
            'i=0; while true; do echo "$i: $(date)"; i=$((i+1)); sleep 1; done']

其中：
counter- pod 的
count 名称 - “counter” pod 内的容器名称

您可以通过运行以下命令访问该文件的内容： 

$ kubectl logs counter

您可以通过以下命令访问 Pod 中先前崩溃的容器的日志文件： 

$ kubectl logs --previous

如果 pod 中有多个容器，则应添加容器名称，如下所示：

$ kubectl logs counter -c count

当 pod 从集群中移除时，它的所有日志（当前和以前的）也会被移除。

确保您在应用程序中正确配置标准输出，并且应用程序中标准输出的输出不会因任何原因而静默跳过。

于 2018-05-10T15:39:59.997 回答
1

好的，所以这终于解决了。问题在于未刷新日志。

在 PatternLayout 中缺少 %n。因此，我猜一切都进入了一些缓冲区，而没有到达控制台。

于 2018-05-11T20:51:14.760 回答