通过docker直接部署promtail采集系统日志，并推送到loki，如需要采集其他日志，增加挂载目录并修改配置即可。
这里假定已经部署了loki。

准备配置

在root目录下新建promtail文件夹，并创建promtail.yaml配置，内容如下，根据需要修改clients地址和采集配置scrape_configs:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
server:
  log_level: info
  http_listen_port: 3101
  

clients:
  - url: http://192.168.0.111:58591/loki/api/v1/push

positions:
  filename: /run/promtail/positions.yaml

scrape_configs:
  # See also https://github.com/grafana/loki/blob/master/production/ksonnet/promtail/scrape_config.libsonnet for reference
  # Add an additional scrape config for syslog
  - job_name: journal
    journal:
      path: /run/log/journal
      max_age: 12h
      labels:
        job: systemd-journal
    relabel_configs:
      - action: replace
        replacement: $1
        separator: /
        source_labels:
        - job
        - __journal__hostname
        target_label: job
      - source_labels:
          - __journal__hostname
        target_label: hostname
      # example label values: kubelet.service, containerd.service
      - source_labels:
          - __journal__systemd_unit
        target_label: unit
      # example label values: debug, notice, info, warning, error
      - source_labels:
          - __journal_priority_keyword
        target_label: level

运行promtail

1
2
3
4
5
6
7
8
9
10
11
docker run -d \
  -v /root/promtail:/etc/promtail \
  -v /etc/machine-id:/etc/machine-id \
  -v /run/promtail:/run/promtail \
  -v /run/log/journal:/run/log/journal \
  --name promtail \
  --restart always \
  --read-only \
  -p 3101:3101 \
  docker.io/grafana/promtail:2.6.1 \
  -config.file=/etc/promtail/promtail.yaml

如需要采集容器或者pod的日志，需要增加挂载目录样例如下，当然配置中也需要增加相关配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
docker run -d \
  -v /root/promtail:/etc/promtail \
  -v /etc/machine-id:/etc/machine-id \
  -v /run/promtail:/run/promtail \
  -v /run/log/journal:/run/log/journal \
  -v /data/docker/containers:/data/docker/containers \
  -v /var/log/pods:/var/log/pods \
  -v /var/lib/docker/containers:/var/lib/docker/containers \
  --name promtail \
  --restart always \
  --read-only \
  -p 3101:3101 \
  docker.io/grafana/promtail:2.6.1 \
  -config.file=/etc/promtail/promtail.yaml

配置参考

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
- job_name: kubernetes-pods
  pipeline_stages:
    - docker: {}
    - multiline:
        firstline: ^\d{4}-\d{2}-\d{2}
        max_lines: 300
  kubernetes_sd_configs:
    - role: pod
  relabel_configs:
    - source_labels:
        - __meta_kubernetes_namespace
      action: drop
      regex: sy-data 
    - source_labels:
        - __meta_kubernetes_pod_controller_name
      regex: ([0-9a-z-.]+?)(-[0-9a-f]{8,10})?
      action: replace
      target_label: __tmp_controller_name
    - source_labels:
        - __meta_kubernetes_pod_label_app_kubernetes_io_name
        - __meta_kubernetes_pod_label_app
        - __tmp_controller_name
        - __meta_kubernetes_pod_name
      regex: ^;*([^;]+)(;.*)?$
      action: replace
      target_label: app
    - source_labels:
        - __meta_kubernetes_pod_label_app_kubernetes_io_instance
        - __meta_kubernetes_pod_label_release
      regex: ^;*([^;]+)(;.*)?$
      action: replace
      target_label: instance
    - source_labels:
        - __meta_kubernetes_pod_label_app_kubernetes_io_component
        - __meta_kubernetes_pod_label_component
      regex: ^;*([^;]+)(;.*)?$
      action: replace
      target_label: component
    - action: replace
      source_labels:
      - __meta_kubernetes_pod_node_name
      target_label: node_name
    - action: replace
      source_labels:
      - __meta_kubernetes_namespace
      target_label: namespace
    - action: replace
      replacement: $1
      separator: /
      source_labels:
      - namespace
      - app
      target_label: job
    - action: replace
      source_labels:
      - __meta_kubernetes_pod_name
      target_label: pod
    - action: replace
      source_labels:
      - __meta_kubernetes_pod_container_name
      target_label: container
    - action: replace
      replacement: /var/log/pods/*$1/*.log
      separator: /
      source_labels:
      - __meta_kubernetes_pod_uid
      - __meta_kubernetes_pod_container_name
      target_label: __path__
    - action: replace
      regex: true/(.*)
      replacement: /var/log/pods/*$1/*.log
      separator: /
      source_labels:
      - __meta_kubernetes_pod_annotationpresent_kubernetes_io_config_hash
      - __meta_kubernetes_pod_annotation_kubernetes_io_config_hash
      - __meta_kubernetes_pod_container_name
      target_label: __path__