支持全文索引的搜索引擎，是 Elasticsearch 的轻量级替代品

优点

仅列出我目前在用的功能特性

• 提供全文索引功能
• Elasticsearch API 完全兼容，用于提取数据(单/批量API）
• 开箱即用的身份验证
• 使用Go/Vue开发，支持多平台部署简单，提供可视化UI
• 聚合支持

项目

官方文档

部署

docker

mkdir -p /data/es
docker run -v /data/es:/data -e ZINC_DATA_PATH="/data" -p 4080:4080
-e ZINC_FIRST_ADMIN_USER=ysicing -e ZINC_FIRST_ADMIN_PASSWORD=ysicingme
--name zincsearch ccr.ccs.tencentyun.com/k7scn/zincsearch

k8s部署

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  labels:
    k8s.ysicing.me/name: zincsearch
  name: zincsearch
spec:
  storageClassName: lh
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 20Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    k8s.ysicing.me/name: zincsearch
  name: zincsearch
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s.ysicing.me/name: zincsearch
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        k8s.ysicing.me/name: zincsearch
    spec:
      nodeSelector:
        node-role.kubernetes.io/china: "true"
      containers:
      - image: ccr.ccs.tencentyun.com/k7scn/zincsearch
        imagePullPolicy: Always
        env:
        - name: ZINC_FIRST_ADMIN_USER
          value: ysicing
        - name: ZINC_DATA_PATH
          value: /data
        - name: ZINC_FIRST_ADMIN_PASSWORD
          value: ysicingme
        name: zincsearch
        resources:
          limits:
            cpu: 1024m
            memory: 2048Mi
          requests:
            cpu: 32m
            memory: 50Mi
        volumeMounts:
        - mountPath: /data
          name: zincsearch
      restartPolicy: Always
      initContainers:
        - name: volume-permissions
          image: docker.io/bitnami/os-shell:11-debian-11-r92
          imagePullPolicy: "IfNotPresent"
          command:
            - /bin/bash
          args:
            - -ec
            - |
              mkdir -p /data
              chmod a+rwx /data
          securityContext:
            runAsUser: 0
          resources:
            limits: {}
            requests: {}
          volumeMounts:
            - name: zincsearch
              mountPath: /data
      volumes:
      - name: zincsearch
        persistentVolumeClaim:
          claimName: zincsearch
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s.ysicing.me/name: zincsearch
  name: zincsearch
spec:
  ports:
  - name: http
    port: 4080
    protocol: TCP
    targetPort: 4080
  selector:
    k8s.ysicing.me/name: zincsearch
  type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  labels:
    k8s.ysicing.me/name: zincsearch
  name: zincsearch
spec:
  rules:
  - host: es.i.ysicing.net
    http:
      paths:
      - backend:
          service:
            name: zincsearch
            port:
              name: http
        path: /
        pathType: ImplementationSpecific

将上面的yaml文件保存为zincsearch.yaml, 需要将es.i.ysicing.net改成自己的域名哈

生效

kubectl apply -f zincsearch.yaml

收集日志

我使用的是sidecar方式收集的，其他方式也可以。

apiVersion: apps.kruise.io/v1alpha1
kind: SidecarSet
metadata:
  name: nginx-ingress-filebeat
spec:
  namespace: kube-system
  updateStrategy:
    type: RollingUpdate
    partition: 0
  selector:
    matchLabels:
      app.kubernetes.io/instance: nginx-ingress-controller
  containers:
  - name: filebeat
    image: hub.i.ysicing.net/devops/filebeat:202312
    volumeMounts:
    - name: log-volume
      mountPath: /var/log/nginxweb
    - name: filebeat
      mountPath: /usr/share/filebeat/data
  volumes:
  - emptyDir: {}
    name: log-volume
  - emptyDir: {}
    name: filebeat

不提供hub.i.ysicing.net/devops/filebeat:202312镜像哈，因为默认有我的凭证，这里给出构建的镜像

filebeat构建

Dockerfile如下, filebeat 这个版本是OK，不同版本下可能适配有问题，如果有问题可以去zincsearch社区反馈

FROM h2.ysicing.net/ysicing/debian as builder

WORKDIR /root

RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.2.3-linux-x86_64.tar.gz \
  && tar xzvf filebeat-8.2.3-linux-x86_64.tar.gz

FROM h2.ysicing.net/ysicing/debian

WORKDIR /root

COPY --from=builder /root/filebeat-8.2.3-linux-x86_64/filebeat /usr/bin/filebeat

COPY --from=builder /root/filebeat-8.2.3-linux-x86_64/module /root/config/module

COPY --from=builder /root/filebeat-8.2.3-linux-x86_64/modules.d /root/config/modules.d

COPY filebeat.yml /root/filebeat.yml

CMD ["/usr/bin/filebeat","-e","-c","/root/filebeat.yml", "--path.data", "/usr/share/filebeat/data", "--path.config", "/root/config"]

filebeat配置如下:

setup.ilm.enabled: false
setup.template.name: "nginx-ingress"
setup.template.pattern: "nginx-ingress-*"
setup.template.settings:
  index.number_of_shards: 1
  index.number_of_replicas: 0
  index.refresh_interval: 5s
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/nginxweb/*.log
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: log
  json.expand_keys: true
  fields:
    app: nginx-ingress

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
#  - add_cloud_metadata: ~
#  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

fields_under_root: true

output.elasticsearch:
  hosts: ["zincsearch.default.svc:4080"]
  protocol: "http"
  path: "/es/"
  username: "ysicing"
  password: "ysicingme"
  index: "nginx-ingress-%{+yyyy.MM.dd}"

根据上面的操作，直接构建出镜像就可以啦。

总结

反正比ES使用简单，基本功能也能满足需求。如果没有其他特殊需求，可以替代。