[root@rancher ~]# helm repo update
Hang tight while we grab the latest from your chart repositories…
…Successfully got an update from the “elastic” chart repository
Update Complete. ⎈Happy Helming!⎈

# 安装Elasticsearch
[root@rancher ~]# helm install elasticsearch elastic/elasticsearch \
–namespace logging \
–create-namespace \
–set replicas=3 \
–set volumeClaimTemplate.resources.requests.storage=200Gi \
–set resources.requests.cpu=4 \
–set resources.requests.memory=8Gi \
–set resources.limits.cpu=8 \
–set resources.limits.memory=16Gi \
–set esJavaOpts=”-Xms8g -Xmx8g”

NAME: elasticsearch
LAST DEPLOYED: Fri Apr 10 10:00:00 2026
NAMESPACE: logging
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
The elasticsearch cluster has been installed.

Elasticsearch can be accessed:

* From inside the cluster by running `kubectl exec -it -n logging elasticsearch-0 — curl http://localhost:9200`

* From outside the cluster by running `kubectl port-forward -n logging svc/elasticsearch-master 9200:9200`

# 查看Elasticsearch状态
[root@rancher ~]# kubectl get pods -n logging
NAME READY STATUS RESTARTS AGE
elasticsearch-0 1/1 Running 0 2m
elasticsearch-1 1/1 Running 0 2m
elasticsearch-2 1/1 Running 0 2m

# 查看Elasticsearch集群状态
[root@rancher ~]# kubectl exec -n logging elasticsearch-0 — curl -s http://localhost:9200/_cluster/health?pretty
{
“cluster_name” : “elasticsearch”,
“status” : “green”,
“number_of_nodes” : 3,
“number_of_data_nodes” : 3,
“active_primary_shards” : 10,
“active_shards” : 20,
“relocating_shards” : 0,
“initializing_shards” : 0,
“unassigned_shards” : 0
}

NAME: kibana
LAST DEPLOYED: Fri Apr 10 10:00:00 2026
NAMESPACE: logging
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Kibana can be accessed:

* From outside the cluster by running `kubectl port-forward -n logging svc/kibana 5601:5601`

# 查看Kibana状态
[root@rancher ~]# kubectl get pods -n logging
NAME READY STATUS RESTARTS AGE
elasticsearch-0 1/1 Running 0 5m
elasticsearch-1 1/1 Running 0 5m
elasticsearch-2 1/1 Running 0 5m
kibana-1234567890-abcde 1/1 Running 0 2m

# 端口转发访问Kibana
[root@rancher ~]# kubectl -n logging port-forward svc/kibana 5601:5601 &
Forwarding from 127.0.0.1:5601 -> 5601
Forwarding from [::1]:5601 -> 5601

# 访问Kibana
# URL: http://localhost:5601
# 用户名：elastic
# 密码：查看Elasticsearch密码

[root@rancher ~]# helm repo update
Hang tight while we grab the latest from your chart repositories…
…Successfully got an update from the “fluent” chart repository
Update Complete. ⎈Happy Helming!⎈

# 安装Fluentd
[root@rancher ~]# helm install fluentd fluent/fluentd \
–namespace logging \
–set image.tag=v1.15.3 \
–set resources.requests.cpu=0.5 \
–set resources.requests.memory=512Mi \
–set resources.limits.cpu=1 \
–set resources.limits.memory=1Gi \
–set tolerations[0].key=node-role.kubernetes.io/master \
–set tolerations[0].effect=NoSchedule

NAME: fluentd
LAST DEPLOYED: Fri Apr 10 10:00:00 2026
NAMESPACE: logging
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Fluentd has been installed.

Fluentd can be accessed:

* From inside the cluster by running `kubectl exec -it -n logging fluentd-1234567890-abcde — fluentd –version`

# 查看Fluentd状态
[root@rancher ~]# kubectl get pods -n logging
NAME READY STATUS RESTARTS AGE
elasticsearch-0 1/1 Running 0 10m
elasticsearch-1 1/1 Running 0 10m
elasticsearch-2 1/1 Running 0 10m
kibana-1234567890-abcde 1/1 Running 0 7m
fluentd-1234567890-abcde 1/1 Running 0 2m
fluentd-2345678901-fghij 1/1 Running 0 2m
fluentd-3456789012-klmno 1/1 Running 0 2m

# 查看日志数据
[root@rancher ~]# kubectl exec -n logging elasticsearch-0 — curl -s http://localhost:9200/kubernetes-2026.04.10/_search?pretty | head -50
{
“took” : 5,
“timed_out” : false,
“_shards” : {
“total” : 5,
“successful” : 5,
“skipped” : 0,
“failed” : 0
},
“hits” : {
“total” : {
“value” : 12345,
“relation” : “eq”
},
“max_score” : 1.0,
“hits” : [
{
“_index” : “kubernetes-2026.04.10”,
“_type” : “_doc”,
“_id” : “1234567890abcdef”,
“_score” : 1.0,
“_source” : {
“@timestamp” : “2026-04-10T10:00:00.000Z”,
“log” : “2026/04/10 10:00:00 [info] Application started”,
“stream” : “stdout”,
“kubernetes” : {
“pod_name” : “fgedu-nginx-1234567890-abcde”,
“namespace_name” : “fgedu-dev”,
“pod_id” : “12345678-90ab-cdef-1234-567890abcdef”,
“labels” : {
“app” : “fgedu-nginx”
}
}
}
}
]
}
}

# 通过Kibana查看日志
# 步骤1：登录Kibana界面
# 步骤2：点击”Management” – “Stack Management” – “Index Patterns”
# 步骤3：点击”Create index pattern”
# 步骤4：输入索引模式：kubernetes-*
# 步骤5：选择时间字段：@timestamp
# 步骤6：点击”Create index pattern”
# 步骤7：点击”Discover”查看日志