You can use Alibaba Cloud Filebeat to collect the logs of Container Service for Kubernetes (ACK) clusters and send the collected logs to Alibaba Cloud Elasticsearch for analysis and presentation. This topic describes how to configure a Filebeat shipper to collect the logs of an ACK cluster and how to view the resources that are deployed in the ACK cluster for the shipper.
Prerequisites
- An Alibaba Cloud Elasticsearch cluster is created.
For more information, see Create an Alibaba Cloud Elasticsearch cluster.
- A prefix is customized for the names of indexes that will be automatically created
based on the Auto Indexing feature.
To avoid conflicts between the aliases of the indexes that are generated during a rollover and the names of the indexes, we recommend that you customize the filebeat- prefix for index names. You can enter +.*,+filebeat-*,-* in the Custom field. For more information, see Configure the YML file.Notice If you enable the Rolling Update feature when you configure lifecycle management for indexes in your Elasticsearch cluster, you must disable the Auto Indexing feature to avoid conflicts between the aliases of the indexes that are generated after rolling updates and the names of the indexes. If you do not enable the Rolling Update feature for indexes, you must enable the Auto Indexing feature. We recommend that you customize a prefix for index names.
- The permissions on Beats and ACK clusters are granted to a RAM user.
For more information, see Create a custom policy and Grant permissions to a RAM user.
- An ACK cluster is created, and a pod is created in the cluster. In this example, an
NGINX container is used.
For more information, see Create an ACK managed cluster.
Precautions
- Alibaba Cloud Filebeat shippers support only Docker containers. It does not support containers such as containerd containers and sandboxed containers. If you use containers other than Docker containers, a Filebeat shipper is stuck in the active state after the shipper is created.
- Alibaba Cloud Filebeat shippers can be installed only on ACK dedicated clusters or
managed edge Kubernetes clusters.
Notice Filebeat shippers cannot be installed on Kubernetes clusters of 1.22 or later. We recommend that you use a Kubernetes cluster of another version.
Procedure
View the resources deployed in the ACK cluster for the shipper
Run the following command, use kubectl to connect to the ACK cluster, and view the resources for the shipper in the logging namespace. For more information, see Connect to ACK clusters by using kubectl.
kubectl get pods -n logging

pod name | Description | Examples |
---|---|---|
Cluster name-binding-Serial number | The container that is used to manage indexes, such as a container that is used to delete old data on a regular basis. | ct-cn-ew8qx563gu4ng4ot6-binding-7e245-1617347400-c**** |
Cluster name-policy-Serial number | The policy for rolling updates on indexes. | ct-cn-ew8qx563gu4ng4ot6-policy-696b7-hot-rollover-1g-16173v**** |
Cluster name-Serial number | The container for which the shipper is installed. | ct-cn-ew8qx563gu4ng4ot6-q**** |
es-operator-Serial number | The container for which ES-operator is installed. | es-operator-cb63cc9a6302e4e90aeb2f79adf358b19-56fcd754db-b**** |