硬件环境：

三台虚拟机，

10.10.20.203 部署docker、etcd、flannel、kube-apiserver、kube-controller-manager、kube-scheduler、elsticsearch、kibana

10.10.20.206 部署docker、flannel、kubelet、kube-proxy、filebeat

10.10.20.207 部署docker、flannel、kubelet、kube-proxy、filebeat

【elsticsearch】

1、下载rpm安装包，wget https://download.elastic.co/elasticsearch/release/org/elasticsearch/distribution/rpm/elasticsearch/2.3.5/elasticsearch-2.3.5.rpm

2、安装，yum localinstall elasticsearch-2.3.5.rpm

3、修改配置文件，vi /etc/elasticsearch/elasticsearch.yml

network.host: 10.10.20.203

4、重启服务

systemctl enable elasticsearch.servicesystemctl restart elasticsearch.servicesystemctl status elasticsearch.service

【kibana】

1、下载rpm安装包，wget https://download.elastic.co/kibana/kibana/kibana-4.5.4-1.x86_64.rpm

2、安装，yum localinstall kibana-4.5.4-1.x86_64.rpm

3、修改配置文件，vi /opt/kibana/config/kibana.yml

elasticsearch.url: "http://10.10.20.203:9200"

4、重启服务

systemctl enable kibana.servicesystemctl restart kibana.servicesystemctl status kibana.service -l

【filebeat】

在需要搜集日志的服务器上安装filebeat

1、下载rpm安装包，wget https://download.elastic.co/beats/filebeat/filebeat-1.2.3-x86_64.rpm

2、安装，yum localinstall filebeat-1.2.3-x86_64.rpm

3、修改配置文件，vi /etc/filebeat/filebeat.yml

filebeat:  prospectors:    -      paths:        - /var/log/messages      input_type: log      document_type: syslog    -      paths:        - /opt/logs/tomcatlog/catalina.*.log      input_type: log      document_type: tomcatlog    -      paths:        - //var/lib/docker/containers/*/*-json.log      input_type: log      document_type: containerlog  registry_file: /var/lib/filebeat/registry output:  elasticsearch:    hosts: ["10.10.20.203:9200"]    index: "filebeat"

4、重启服务

systemctl enable filebeatsystemctl restart filebeatsystemctl status filebeat -l

5、访问http://10.10.20.203:5601/，新建filebeat-*这个index，即可查看日志

k8s集群日志