Create an SLS CRD in an ACK Serverless cluster to collect ECI logs - Elastic Container Instance

Background information

Simple Log Service is a one-stop service for log data. It lets you quickly collect, consume, ship, query, and analyze log data without writing code. For more information, see What is Simple Log Service?.

Prerequisites

Ensure that Simple Log Service is activated. If the service is not activated, you will be prompted to activate it when you log on to the Simple Log Service console. Follow the on-screen instructions to complete the activation.

Notes

Log collection enabled by an SLS CRD applies only to subsequently created ECI pods. To collect logs from existing pods, you must perform a rolling update.

Configure log collection

After deploying the alibaba-log-controller component in your cluster, you can use the AliyunLogConfig CRD to configure log collection.

Deploy the alibaba-log-controller component

Log on to the ACK console.
In the upper-left corner of the top navigation bar, select a region.
On the Clusters page, click the name of the target ACK Serverless cluster to open the cluster details page.
Deploy the alibaba-log-controller component in the cluster.
1. In the left-side navigation pane of the cluster details page, choose Operations > Add-ons.
2. Click the Logs and Monitoring tab, find the alibaba-log-controller card, and then click Install.
3. In the dialog box that appears, click OK.
  
  After the installation is complete, the alibaba-log-controller card displays Installed in the upper-right corner.

Create a Logtail configuration

Connect to the ACK Serverless cluster.

Create a YAML configuration file for the AliyunLogConfig CRD.

Important

To avoid configuration drift, always update the configuration by modifying the CRD resource. Changes made directly in the console are not synchronized back to the CRD.

AliyunLogConfig CRD YAML template

apiVersion: log.alibabacloud.com/v1alpha1     
kind: AliyunLogConfig                         
metadata:
  name: simple-stdout-example                 
spec:
  project: k8s-my-project                      
  logstore: k8s-stdout                         
  logstoreMode: standard                       
  shardCount: 2                               
  lifeCycle: 90                               
  logtailConfig:                            
    inputType: plugin                          
    configName: simple-stdout-example          
    inputDetail:                               
      ...

The following table describes the basic parameters. For more information about the parameters, see Use AliyunLogConfig to manage collection configurations.

Basic parameters

Parameter	Type	Required	Description
project	string	No	The name of the project. This parameter defaults to the project specified when you install the Logtail component. If the specified project does not exist, it is automatically created.
logstore	string	Yes	The name of the Logstore. If the specified Logstore does not exist, it is automatically created.
logstoreMode	string	No	The type of the Logstore. This parameter takes effect only when a new Logstore is created. Valid values: query: Query Logstore standard: Standard Logstore For more information, see Manage a Logstore.
shardCount	int	No	The number of shards. Default value: 2. Valid values: 1 to 10.
lifeCycle	int	No	The retention period of data in the Logstore, in days. Default value: 90. Valid values: 1 to 3650. A value of 3650 indicates permanent storage. This parameter takes effect only when a new Logstore is created.
machineGroups	array	No	Machine group. When you install the Logtail component, Simple Log Service automatically creates a machine group named `k8s-group-${your_k8s_cluster_id}`.
logtailConfig	object	Yes	The Logtail configuration. The following parameters are included: configName: The name of the Logtail configuration. The name must be the same as metadata.name. inputType: The log input method. Valid values: plugin: collects logs such as MySQL Binlog using Logtail plug-ins. file: collects logs from text files using a fixed mode, such as regular expression or delimiter mode. inputDetail: The configuration settings for the log input. outputType: The log output method. Only LogService is supported, which means that data can be uploaded only to Simple Log Service. outputDetail: The configuration settings for the log output. logSample: A sample log. For more information about the parameters, see Logtail configurations (legacy).

Container filtering
- For Logtail versions earlier than 1.0.34, container filtering is supported only via environment variables and container labels.
  
  The Kubernetes namespace and container names are mapped to the io.kubernetes.pod.namespace and io.kubernetes.container.name container labels, respectively. We recommend that you use these labels to filter containers. If these labels do not meet your requirements, use an allowlist and denylist of environment variables to filter containers.
- For Logtail 1.0.34 and later, you can use Kubernetes-level information, such as pod name, namespace, container name, and container labels, for container filtering.
  
  Configure the container filtering parameters in the logtailConfig.inputDetail.advanced.k8s field. The supported parameters are as follows:
  - IncludeK8sLabel: An allowlist of Kubernetes labels. Only containers with matching labels are targeted for log collection.
  - ExcludeK8sLabel: A blocklist of Kubernetes labels. Log collection is skipped for containers with matching labels.
  - K8sNamespaceRegex: A regular expression to match the namespace.
  - K8sPodRegex: A regular expression to match the pod name.
  - K8sContainerRegex: A regular expression to match the container name.

Sample AliyunLogConfig CRD YAML files

Text logs

Save the following content as log-file.yaml.

apiVersion: log.alibabacloud.com/v1alpha1  # Use the default value. Do not modify.
kind: AliyunLogConfig                      # Use the default value. Do not modify.
metadata:
  name: test-file                  # Resource name, unique in the current Kubernetes cluster.
spec:
  project: k8s-log-c326bc86****    # Optional. The project name. If the project does not exist, the system automatically creates it.
  logstore: test-file              # Required. The Logstore name. If the Logstore does not exist, the system automatically creates it.  
  logtailConfig:                   # Logtail configuration
    inputType: file                # Data source type. file = text log. plugin = stdout.
    configName: test-file          # The name of the Logtail configuration. Must match the resource name (metadata.name).
    inputDetail:                   # Detailed Logtail settings
      logType: common_reg_log      # Collect text logs in simple mode.
      logPath: /log/               # Path to the log files.
      filePattern: "*.log"         # File name pattern. Wildcard characters, such as the asterisk (*) and question mark (?), are supported. Example: log_*.log.
      dockerFile: true             # To collect logs from files in a container, set dockerFile to true.
      advanced:                    # Container filtering settings.
        k8s:
          K8sNamespaceRegex: ^(default)$
          K8sPodRegex: '^(eci-sls-demo.*)$'

Standard output

Save the following content as log-stdout.yaml.

apiVersion: log.alibabacloud.com/v1alpha1   # Use the default value. Do not modify.
kind: AliyunLogConfig                       # Use the default value. Do not modify.
metadata:
  name: test-stdout               # Resource name, unique in the current Kubernetes cluster.
spec:
  project: k8s-log-c326bc86****   # Optional. The project name. If the project does not exist, the system automatically creates it.
  logstore: test-stdout           # Required. The Logstore name. If the Logstore does not exist, the system automatically creates it.                 
  shardCount: 2                   # Optional. The number of shards. Default: 2. Valid values: 1 to 10.                         
  lifeCycle: 90                   # Optional. Log retention period in days (effective for new Logstores). Default: 90. Range: 1-3650 (3650 means permanent).
  logtailConfig:                  # Logtail configuration
    inputType: plugin             # Data source type. file = text log. plugin = stdout.                                
    configName: test-stdout       # The name of the Logtail configuration. Must match the resource name (metadata.name).
    inputDetail:                  # Detailed Logtail settings
      plugin:
        inputs:
          - type: service_docker_stdout
            detail:
              Stdout: true
              Stderr: true
#              IncludeEnv:
#                aliyun_logs_test-stdout: "stdout"

Create the AliyunLogConfig CRD.

Run the following commands to apply the configurations. After the Logtail configuration takes effect, Logtail starts to collect stdout or text logs from matching containers and sends them to Simple Log Service.
```
kubectl apply -f log-file.yaml
kubectl apply -f log-stdout.yaml
```
Important
After logs are collected, you must create an index before you can query and analyze logs in the Logstore. For more information, see Create Index.

Test log collection

After you create the AliyunLogConfig CRD, Simple Log Service automatically collects logs from newly created pods. You can create the following application to test log collection.

Create an application.

The following example uses a Deployment. Once started, the container continuously prints logs to stdout and a log file.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: eci-sls-demo
  labels:
    app: sls
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sls
  template:
    metadata:
      name: sls-test
      labels:
        app: sls
        alibabacloud.com/eci: "true" 
    spec:
      containers:
      - args:
        - -c
        - mkdir -p /log;while true; do echo hello world; date; echo hello sls >> /log/busy.log; sleep 1;done
        command:
        - /bin/sh
        image: registry-vpc.cn-beijing.aliyuncs.com/eci_open/busybox:1.30
        imagePullPolicy: Always
        name: busybox

Save the preceding YAML file as test-sls-crd.yaml and run the following command to create the application.

kubectl create -f test-sls-crd.yaml

Verify the application status.

kubectl get pod

Expected output:

NAME                            READY   STATUS    RESTARTS   AGE
eci-sls-demo-7bf8849b9f-cgpbn   1/1     Running   0          2m14s

View the logs.
1. Log on to the Simple Log Service console.
2. Click the name of the destination project.
3. Find the destination Logstore and click its name to view the logs.
  
  Text logs
  
  In the Simple Log Service console, select the test-file Logstore to view the collected file logs. The log entries include key fields such as __container_name__ with the value sls, __image_name__ with the value registry-vpc.cn-beijing.aliyuncs.com/eci_open/busybox:1.30, __namespace__ with the value default, and content with the value hello sls, confirming that logs from the busybox container were successfully collected.
  
  Standard output
  
  In the Simple Log Service console, select the test-stdout Logstore from the list on the left to view the collected stdout logs. The log entries contain fields like _container_name_ (value: sls), _image_name_ (the busybox image URL), _namespace_ (default), and _source_ (stdout). The content field displays the container output, such as hello world.

Disable log collection

After you create a log collection configuration CRD, the system automatically collects logs from all matching Pods. For Pods that you do not want to collect logs from, you can add the k8s.aliyun.com/eci-sls-enable: "false" annotation to disable log collection. This prevents the system from automatically creating Logtail instances and avoids wasting resources.

Important

Annotations must be added to the metadata in the configuration file of the pod. For example, when you create a Deployment, you must add annotations in the spec.template.metadata section.
Elastic Container Instance-related annotations are only applied when a pod is created. Adding or modifying these annotations on an existing pod will have no effect.

Example:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: eci-sls-demo2
  labels:
    app: sls
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sls
  template:
    metadata:
      name: sls-test
      labels:
        app: sls
        alibabacloud.com/eci: "true"
      annotations:
        k8s.aliyun.com/eci-sls-enable: "false"    # Disable log collection.
    spec:
      containers:
      - args:
        - -c
        - mkdir -p /log;while true; do echo hello world; date; echo hello sls >> /log/busy.log; sleep 1;
          done
        command:
        - /bin/sh
        image: registry.cn-shanghai.aliyuncs.com/eci_open/busybox:1.30
        imagePullPolicy: Always
        name: busybox