Docker之pod内日志的导出

1. 将符合条件的记录导出到文件

curl -XPOST "https://<ip:port>/log-v2/_search?scroll=20m" -H 'Content-Type: application/json' -d'
{
  "size":1000,
  "_source": "message", 
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "message": "query"
          }
        },
        {
          "match": {
            "level": "INFO"
          }
        },
        {
          "match": {
            "fields.svcname": "test-svc"
          }
        }
      ],
      "must_not": [
        {
          "match_phrase": {
            "message": "\"query\":null"
          }
        }
      ]
      
    }
  }
}'  | json_pp |tac |tac  >>  /usr/local/zd/data/query-message-all-pretty.json

 curl -XPOST "https://<ip:port>/_search/scroll" -H 'Content-Type: application/json' -d'
{
  "scroll_id" : "DnF1ZXJ5VGhlbkZldGNoBQAAAAAAEH64FmZNTnZIaEdGUmVpcGxXc21IWkZHdUEAAAAAABB-uRZmTU52SGhHRlJlaXBsV3NtSFpGR3VBAAAAAAAVb-oWVGFkY2IyTzdUUm1RbHgwSEtRVU1CdwAAAAAAFW_rFlRhZGNiMk83VFJtUWx4MEhLUVVNQncAAAAAABVv7BZUYWRjYjJPN1RSbVFseDBIS1FVTUJ3",
  "scroll":"20m"
}' | json_pp |tac |tac  >>  /usr/local/zd/data/query-message-all-pretty.json

备份

curl -XPOST "https://<ip:port>/log-v2/_search?scroll=10m" -H 'Content-Type: application/json' -d'
{
  "size":1,
  "_source": "message", 
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "message": "query"
          }
        },
        {
          "match": {
            "level": "INFO"
          }
        },
        {
          "match": {
            "fields.svcname": "test-svc"
          }
        }
      ],
      "must_not": [
        {
          "match_phrase": {
            "message": "\"query\":null"
          }
        }
      ]
      
    }
  }
}' | json_pp |tac |tac  >>  /usr/local/zd/data/query-message-all-pretty.json


curl -XPOST "https://vpc-vova-rec-log-ryxjm2a4suwdlanzghol3eyctm.us-east-1.es.amazonaws.com:443/_search/scroll" -H 'Content-Type: application/json' -d'
{
  "scroll_id" : "DnF1ZXJ5VGhlbkZldGNoBQAAAAAAEH2FFmZNTnZIaEdGUmVpcGxXc21IWkZHdUEAAAAAABB9hhZmTU52SGhHRlJlaXBsV3NtSFpGR3VBAAAAAAAVbmYWVGFkY2IyTzdUUm1RbHgwSEtRVU1CdwAAAAAAFW5oFlRhZGNiMk83VFJtUWx4MEhLUVVNQncAAAAAABVuZxZUYWRjYjJPN1RSbVFseDBIS1FVTUJ3",
  "scroll":"1m"
}' | json_pp |tac |tac  >>  /usr/local/zd/data/query-message-all-pretty.json

导出pod

在pod外执行 kubeclt cp 命令

kubectl cp <namespace>/<pod-name>:/usr/local/zd/data/query-message-all-pretty.json /home/Admin/usr/fn-search/query-message-all-pretty-1.json