背景

在不重启apiserver的情况下，把events导出到es中。这里选择了kubernetes-event-exporter。
GitHub地址：https://github.com/resmoio/kubernetes-event-exporter

部署

我的k8s版本是1.20.15，es版本7.10.0，这里只能选择2.1.2版本的chart，别的版本es客户端高于7.10，会导致exporter无法连接es。（经过多次尝试终于有个能用的...）
https://artifacthub.io/packages/helm/bitnami/kubernetes-event-exporter/2.1.2

下载chart包，修改values.yaml，安装。

helm pull bitnami/kubernetes-event-exporter --version 2.1.2
tar xvf kubernetes-event-exporter-2.1.2.tgz
vim values.yaml

fullnameOverride: "event-exporter"
config:
  logLevel: debug
  logFormat: json
  kubeQPS: 100
  kubeBurst: 500
  maxEventAgeSeconds: 60
  metricsNamePrefix: event_exporter_
  receivers:
    - name: "dump"
      elasticsearch:
        hosts:
          - http://1.2.3.4:9200
        username: elastic
        password: elastic
        index: kube-events
        #indexFormat: "kube-events-{2006-01-02}"
        use_ilm: false
        useEventID: true
        layout:
          message: "{{ .Message }}"
          reason: "{{ .Reason }}"
          type: "{{ .Type }}"
          count: "{{ .Count }}"
          kind: "{{ .InvolvedObject.Kind }}"
          name: "{{ .InvolvedObject.Name }}"
          namespace: "{{ .Namespace }}"
          component: "{{ .Source.Component }}"
          host: "{{ .Source.Host }}"
        #layout: {}
  route:
    routes:
      - match:
          - receiver: "dump"

helm install event-exporter -n ns .

注意这里我的es是禁止自动创建索引的，所以我禁用了ilm生命周期管理，使用kube-events这一个索引。如果es支持自动创建索引，可以使用indexFormat。

查看pod

查看日志

查看kube-events索引

自动清理

创建ilm

curl -X PUT "http://elasticsearch:9200/_ilm/policy/kube-events-policy" -H 'Content-Type: application/json' -d'
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_age": "2d",    # 每2天滚动一次
            "max_size": "1gb"   # 或按大小滚动
          },
          "set_priority": {
            "priority": 100
          }
        }
      },
      "delete": {
        "min_age": "3d",        # 保留3天后删除
        "actions": {
          "delete": {}
        }
      }
    }
  }
}'

创建模板关联ilm

curl -X PUT "http://elasticsearch:9200/_index_template/kube-events-template" -H 'Content-Type: application/json' -d'
{
  "index_patterns": ["kube-events-*"], 
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 1,
      "index.lifecycle.name": "kube-events-policy",        # 关联ILM策略
      "index.lifecycle.rollover_alias": "kube-events"      # 设置滚动别名
    }
  }
}'

创建索引设置别名

# 创建第一个索引
curl -X PUT "http://elasticsearch:9200/kube-events-000001" -H 'Content-Type: application/json' -d'
{
  "aliases": {
    "kube-events": {
      "is_write_index": true   # 标记为当前写入索引
    }
  }
}'

# 将ILM策略应用到初始索引
curl -X PUT "http://elasticsearch:9200/kube-events-000001/_settings" -H 'Content-Type: application/json' -d'
{
  "index.lifecycle.name": "kube-events-policy",
  "index.lifecycle.rollover_alias": "kube-events"
}'

验证配置

# 检查别名配置
curl "http://elasticsearch:9200/_cat/aliases/kube-events?v"

# 检查索引设置
curl "http://elasticsearch:9200/kube-events-000001/_settings?pretty"

# 检查ILM状态
curl "http://elasticsearch:9200/kube-events-000001/_ilm/explain?human"