I deployed a elastic agent DaemonSet to monitor elasticsearch cluster, but elastic agent mounts /var/log/containers
, /var/log/pods
, /var/lib/docker/containers
to read container log, but these log files are only contain console log. If i modified log4j2.properties
and changed to RollingFile
, those paths become useless.
When i want to use
RollingFile
, i have to create PVC to share log to elastic agent?
Or
I should use
RollingFile
andConsole
mode at the same time? But all kinds of logs mix in one log file whether elastic agent can handle it properly?
This is my agent manifest
apiVersion: agent.k8s.elastic.co/v1alpha1
kind: Agent
metadata:
name: elastic-agent
namespace: elastic-system
spec:
version: 8.8.0
kibanaRef:
name: kibana-cluster
fleetServerRef:
name: fleet-server
mode: fleet
policyID: eck-agent
daemonSet:
podTemplate:
spec:
serviceAccountName: elastic-agent
hostNetwork: true
# hostPID: true
dnsPolicy: ClusterFirstWithHostNet
automountServiceAccountToken: true
securityContext:
runAsUser: 0
containers:
- name: agent
volumeMounts:
- name: varlogcontainers
mountPath: /var/log/containers
readOnly: true
- name: varlogpods
mountPath: /var/log/pods
readOnly: true
- name: varlibdockercontainers
mountPath: /var/lib/docker/containers
readOnly: true
volumes:
- name: varlogcontainers
hostPath:
path: /var/log/containers
- name: varlogpods
hostPath:
path: /var/log/pods
- name: varlibdockercontainers
hostPath:
path: /var/lib/docker/containers