时间戳

首页 > 解决方案 > docker 中的 Fluentd 无法从我的日志文件中拖尾

docker - docker 中的 Fluentd 无法从我的日志文件中拖尾

问题描述

Docker 中的Fluentd无法从我的日志文件中删除

我的输入/var/log/logf/a.log：

test 1st log
test 2nd log
test 3rd log

和我的配置/opt/app/conf/fluent.conf：

<source>
   @type tail
   path /var/log/logf/a.log
   tag test
   read_from_head true
   <parse>
      @type none
      message_key test
   </parse>
</source>

<match test>
   @type stdout
</match>

和我的Dockerfile身份证/opt/app/Dockerfile

FROM fluent/fluentd:v1.11-debian-1
USER root

COPY ./conf/fluent.conf /fluentd/etc
RUN ["gem", "install", "fluent-plugin-elasticsearch", "--no-document", "--version", "3.5.2"]
USER fluent

我跑我的Dockerfile

$ sudo docker build -t log-app .
$ sudo docker run -d --name logging log-app:latest
$ sudo docker logs -f logging

结果卡住了，我不知道为什么

2020-10-26 10:24:58 +0000 [info]: parsing config file is succeeded path="/fluentd/etc/fluent.conf"
2020-10-26 10:24:58 +0000 [info]: gem 'fluent-plugin-elasticsearch' version '3.5.2'
2020-10-26 10:24:58 +0000 [info]: gem 'fluentd' version '1.11.4'
2020-10-26 10:24:58 +0000 [warn]: 'pos_file PATH' parameter is not set to a 'tail' source.
2020-10-26 10:24:58 +0000 [warn]: this parameter is highly recommended to save the position to resume tailing.
2020-10-26 10:24:58 +0000 [info]: using configuration file: <ROOT>
 <source>
   @type tail
   path "/var/log/logf/a.log"
   tag "test"
   read_from_head true
   <parse>
      @type "none"
      message_key "test"
      unmatched_lines
   </parse>
 </source>
 <match test>
    @type stdout
 </match>
</ROOT>
2020-10-26 10:24:58 +0000 [info]: starting fluentd-1.11.4 pid=6 ruby="2.6.6"
2020-10-26 10:24:58 +0000 [info]: spawn command to main:  cmdline=["/usr/local/bin/ruby", "-Eascii- 8bit:ascii-8bit", "/usr/local/bundle/bin/fluentd", "-c", "/fluentd/etc/fluent.conf", "-p", "/fluentd/plugins", "--under-supervisor"]
2020-10-26 10:24:59 +0000 [info]: adding match pattern="test" type="stdout"
2020-10-26 10:24:59 +0000 [info]: adding source type="tail"
2020-10-26 10:24:59 +0000 [warn]: #0 'pos_file PATH' parameter is not set to a 'tail' source.
2020-10-26 10:24:59 +0000 [warn]: #0 this parameter is highly recommended to save the position to resume tailing.
2020-10-26 10:24:59 +0000 [info]: #0 starting fluentd worker pid=15 ppid=6 worker=0
2020-10-26 10:24:59 +0000 [info]: #0 fluentd worker is now running worker=0

我认为这是一个权限问题，但我不确定因为这个Fluentd不会抛出错误，你们能解决这个问题吗？

[已解决]完全由 karan shah 先生的解释解决

我用带有安装卷的 docker-compose 解决了，如下：

在文件中/opt/app/docker-compose.yaml

version: '2'

services:
  fluentd:
    build: .
    container_name: fl-logging
    volumes:
      - "./conf/:/fluentd/etc:ro"
      - "/var/log/logf:/var/log/logf"

并运行 docker compose

 $ sudo docker-compose up -d --build

标签： dockerloggingkuberneteselastic-stackfluentd

解决方案

问题是您没有将本地日志文件挂载到 Fluentd 容器中以使其可访问。

使用如下命令。

sudo docker run -d --name logging -v PATHTOYOURLOGFILE:/var/log/logf/ log-app:latest

在此处阅读有关卷的更多信息。

您还可以使用 docker-compose 文件，如下所示

version: '2.2'
services:
 fluentd:
    build: ./opt/app/
    container_name: fl01
    volumes:
      - "/opt/app/conf/:/fluentd/etc/:ro"
      - "PATHTOYOURLOGFILE:/var/log/logf/"
    networks:
      - elastic
    ports:
      - "9880:9880"
networks:
  elastic:
    driver: bridge

推荐阅读