Container Service for Kubernetes:Analyze nginx-ingress-controller access logs with SLS

ACK console

1. Log on to the ACK console. In the left-side navigation pane, click ACK consoleClusters.

2. On the Clusters page, click the target cluster. In the left-side navigation pane, choose Operations > Add-ons.

3. On the Add-ons page, click the Networking tab. On the Nginx Ingress Controller card, click the icon and select Enable Log Collection. Click OK.

CLI

ACK provides a CRD named AliyunLogConfig. When you create an AliyunLogConfig, alibaba-log-controller automatically generates the SLS configuration and updates the dashboards.

1. Create a file named k8s-nginx-ingress.yaml with the following content:

   Set IncludeLabel to Docker labels from docker inspect. io.kubernetes.pod.namespace selects by namespace; io.kubernetes.container.name selects by container. For example, io.kubernetes.pod.namespace: backend-prod collects all containers in that namespace; io.kubernetes.container.name: worker-server targets a specific container. Specify only these two labels. To filter by environment variables, use IncludeEnv or ExcludeEnv. See Use the Simple Log Service console to collect container stdout and stderr in DaemonSet mode.

   Field	Description	Modify?
   metadata.namespace	Namespace of the Ingress controller	Yes, if not kube-system
   spec.logstore	SLS Logstore name	Optional
   IncludeLabel	Docker labels used to select containers	Yes, if collecting from a specific namespace
   processor_regex > Regex	Log parsing regex	Only if you changed the default log format

   apiVersion: log.alibabacloud.com/v1alpha1
   kind: AliyunLogConfig
   metadata:
     # Unique name for this AliyunLogConfig within the cluster.
     name: k8s-nginx-ingress
     # Set to the namespace of the Ingress controller you want to collect logs from.
     namespace: kube-system
   spec:
     # The SLS Logstore where logs are stored.
     logstore: nginx-ingress
     # Product code — do not change this value.
     productCode: k8s-nginx-ingress
     logtailConfig:
       inputType: plugin
       # Must match metadata.name.
       configName: k8s-nginx-ingress
       inputDetail:
         plugin:
           inputs:
             - type: service_docker_stdout
               detail:
                 IncludeLabel:
                   # Collect logs from the nginx-ingress-controller container.
                   # If multiple Ingress controllers run in your cluster, collecting
                   # by container name may produce duplicate logs. Review the
                   # IncludeLabel behavior before applying.
                   io.kubernetes.container.name: nginx-ingress-controller
                 Stderr: true
                 Stdout: true
           processors:
             - type: processor_regex
               detail:
                 KeepSource: false
                 # Fields extracted from each log line, in order:
                 Keys:
                   - client_ip
                   - x_forward_for
                   - remote_user
                   - time
                   - method
                   - url
                   - version
                   - status
                   - body_bytes_sent
                   - http_referer
                   - http_user_agent
                   - request_length
                   - request_time
                   - proxy_upstream_name
                   - upstream_addr
                   - upstream_response_length
                   - upstream_response_time
                   - upstream_status
                   - req_id
                   - host
                   - proxy_alternative_upstream_name
                 NoKeyError: true
                 NoMatchError: true
                 # Regular expression that maps each capture group to the Keys above.
                 Regex: ^(\S+)\s-\s\[([^]]+)]\s-\s(\S+)\s\[(\S+)\s\S+\s"(\w+)\s(\S+)\s([^"]+)"\s(\d+)\s(\d+)\s"([^"]*)"\s"([^"]*)"\s(\S+)\s(\S+)+\s\[([^]]*)]\s(\S+?(?:,\s\S+?)*)\s(\S+?(?:,\s\S+?)*)\s(\S+?(?:,\s\S+?)*)\s(\S+?(?:,\s\S+?)*)\s(\S+)\s*(\S*)\s*\[*([^]]*)\]*.*
                 SourceKey: content

   The following table describes the fields you are most likely to customize:

2. Apply the configuration:

   kubectl apply -f k8s-nginx-ingress.yaml

To disable log collection, delete the AliyunLogConfig:

kubectl delete aliyunlogconfig k8s-nginx-ingress -n kube-system