创建部署问题时，请参考下面模板，你提供的信息越多，越容易及时获得解答。如果未按模板创建问题，管理员有权关闭问题。
确保帖子格式清晰易读，用 markdown code block 语法格式化代码块。
你只花一分钟创建的问题，不能指望别人花上半个小时给你解答。

操作系统信息
腾讯云TKE托管master，worker是腾讯云虚拟机，系统是TencentOS Server release 3.1 (Final)三台8C16G

Kubernetes版本信息
[root@gz7-test-k8s-node:~]# kubectl version

WARNING: This version information is deprecated and will be replaced with the output from kubectl version –short. Use –output=yaml|json to get the full version.

Client Version: version.Info{Major:“1”, Minor:“24+”, GitVersion:“v1.24.4-tke.6”, GitCommit:“b7843f18423d5d0db1496340396f7b1459b69016”, GitTreeState:“clean”, BuildDate:“2023-03-08T11:32:25Z”, GoVersion:“go1.18.8”, Compiler:“gc”, Platform:“linux/amd64”}

Kustomize Version: v4.5.4

Server Version: version.Info{Major:“1”, Minor:“24+”, GitVersion:“v1.24.4-tke.6”, GitCommit:“b7843f18423d5d0db1496340396f7b1459b69016”, GitTreeState:“clean”, BuildDate:“2023-03-08T11:25:01Z”, GoVersion:“go1.18.8”, Compiler:“gc”, Platform:“linux/amd64”}

[root@gz7-test-k8s-node:~]#

容器运行时
[root@gz7-test-k8s-node:~]# crictl version

Version: 0.1.0

RuntimeName: containerd

RuntimeVersion: v1.6.9-tke.2

RuntimeApiVersion: v1

[root@gz7-test-k8s-node:~]#

KubeSphere版本信息
v3.3.2。在线安装。在已有K8s上安装

问题是什么
安装完成后events-export服务都没有安装，并且对应的功能没有数据

以下是我的安装步骤：

使用以下命令开启events与auditing组件

kubectl edit cc -n kubesphere-system

  auditing:
    enabled: true
  events:
    enabled: true
    es:
      basicAuth:
        enabled: false
        password: ""
        username: ""
      elkPrefix: logstash
      externalElasticsearchHost: 172.20.148.8
      externalElasticsearchPort: "9200"
  logging:
    containerruntime: containerd
    enabled: true
    logsidecar:
      enabled: true
      replicas: 2

修改完成后重启命令
kubectl rollout restart deploy -n kubesphere-system ks-installer
使用命令查看安装过程正常
kubectl logs -n kubesphere-system $(kubectl get pod -n kubesphere-system -l 'app in (ks-install, ks-installer)' -o jsonpath='{.items[0].metadata.name}') -f

登录平台查看审计与事件日志为空

es没有对应的索引生成

filrbit的配置文件如下

[Service]
    Parsers_File    parsers.conf
[Input]
    Name    systemd
    Path    /var/log/journal
    DB    /fluent-bit/tail/docker.db
    DB.Sync    Normal
    Tag    service.containerd
    Systemd_Filter    _SYSTEMD_UNIT=containerd.service
[Input]
    Name    systemd
    Path    /var/log/journal
    DB    /fluent-bit/tail/kubelet.db
    DB.Sync    Normal
    Tag    service.kubelet
    Systemd_Filter    _SYSTEMD_UNIT=kubelet.service
[Input]
    Name    tail
    Path    /var/log/containers/*.log
    Exclude_Path    /var/log/containers/*_kubesphere-logging-system_events-exporter*.log,/var/log/containers/kube-auditing-webhook*_kubesphere-logging-system_kube-auditing-webhook*.log
    Refresh_Interval    10
    Skip_Long_Lines    true
    DB    /fluent-bit/tail/pos.db
    DB.Sync    Normal
    Mem_Buf_Limit    5MB
    Parser    cri
    Tag    kube.*
[Input]
    Name    tail
    Path    /var/log/containers/kube-auditing-webhook*_kubesphere-logging-system_kube-auditing-webhook*.log
    Refresh_Interval    10
    Skip_Long_Lines    true
    DB    /fluent-bit/tail/pos-auditing.db
    DB.Sync    Normal
    Mem_Buf_Limit    5MB
    Parser    cri
    Tag    kube_auditing
[Input]
    Name    tail
    Path    /var/log/containers/*_kubesphere-logging-system_events-exporter*.log
    Refresh_Interval    10
    Skip_Long_Lines    true
    DB    /fluent-bit/tail/pos-events.db
    DB.Sync    Normal
    Mem_Buf_Limit    5MB
    Parser    cri
    Tag    kube_events
[Filter]
    Name    lua
    Match    kube.*
    script    /fluent-bit/config/containerd.lua
    call    containerd
    time_as_table    true
[Filter]
    Name    parser
    Match    kube_auditing
    Key_Name    message
    Parser    json
[Filter]
    Name    modify
    Match    kube_auditing
    Condition    Key_does_not_exist    AuditID    
    Add    ignore    true
[Filter]
    Name    grep
    Match    kube_auditing
    Exclude    ignore true
[Filter]
    Name    parser
    Match    kube_events
    Key_Name    message
    Parser    json
[Filter]
    Name    kubernetes
    Match    kube.*
    Kube_URL    https://kubernetes.default.svc:443
    Kube_CA_File    /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    Kube_Token_File    /var/run/secrets/kubernetes.io/serviceaccount/token
    Labels    false
    Annotations    false
[Filter]
    Name    nest
    Match    kube.*
    Operation    lift
    Nested_under    kubernetes
    Add_prefix    kubernetes_
[Filter]
    Name    modify
    Match    kube.*
    Remove    stream
    Remove    kubernetes_pod_id
    Remove    kubernetes_host
    Remove    kubernetes_container_hash
[Filter]
    Name    nest
    Match    kube.*
    Operation    nest
    Wildcard    kubernetes_*
    Nest_under    kubernetes
    Remove_prefix    kubernetes_
[Filter]
    Name    lua
    Match    service.*
    script    /fluent-bit/config/systemd.lua
    call    add_time
    time_as_table    true
[Output]
    Name    es
    Match_Regex    (?:kube|service)\.(.*)
    Host    172.20.148.8
    Port    9200
    Logstash_Format    true
    Logstash_Prefix    ks-logstash-log
    Time_Key    @timestamp
    Generate_ID    true
[Output]
    Name    es
    Match    kube_auditing
    Host    172.20.148.8
    Port    9200
    Logstash_Format    true
    Logstash_Prefix    ks-logstash-auditing
    Generate_ID    true
[Output]
    Name    es
    Match    kube_events
    Host    172.20.148.8
    Port    9200
    Logstash_Format    true
    Logstash_Prefix    ks-logstash-events
    Generate_ID    true

containerd.lua:
function containerd( tag, timestamp, record)
       if(record["logtag"]~=nil)
       then
       timeStr = os.date("!*t",  timestamp["sec"])
        t = string.format("%4d-%02d-%02dT%02d:%02d:%02d.%sZ",
        timeStr["year"], timeStr["month"], timeStr["day"],
        timeStr["hour"], timeStr["min"], timeStr["sec"],
        timestamp["nsec"]);
        record["time"] = t;
        record["log"] = record["message"];
        record["message"] =  nil;
        return 1, timestamp, record
        else
        return 0,timestamp,record
       end
end

systemd.lua:
function add_time(tag, timestamp, record)
  new_record = {}
  timeStr = os.date("!*t", timestamp["sec"])
  t = string.format("%4d-%02d-%02dT%02d:%02d:%02d.%sZ",
		timeStr["year"], timeStr["month"], timeStr["day"],
		timeStr["hour"], timeStr["min"], timeStr["sec"],
		timestamp["nsec"])
  kubernetes = {}
  kubernetes["pod_name"] = record["_HOSTNAME"]
  kubernetes["container_name"] = record["SYSLOG_IDENTIFIER"]
  kubernetes["namespace_name"] = "kube-system"
  new_record["time"] = t
  new_record["log"] = record["MESSAGE"]
  new_record["kubernetes"] = kubernetes
  return 1, timestamp, new_record
end

查看服务连events-export服务都没有

fluent-bit日志为

2023-06-01T12:27:50.856761404+08:00 [2023/06/01 04:27:50] [ warn] [engine] chunk '24-1685593656.404851883.flb' cannot be retried: task_id=1, input=systemd.1 > output=es.0

2023-06-01T12:27:51.646624922+08:00 [2023/06/01 04:27:51] [ warn] [http_client] cannot increase buffer: current=512000 requested=544768 max=512000

2023-06-01T12:27:51.650336189+08:00 [2023/06/01 04:27:51] [error] [output:es:es.0] could not pack/validate JSON response

2023-06-01T12:27:51.650361370+08:00 {"took":127,"errors":true,"items":[{"create":{"_index":"ks-logstash-log-2023.05.31","_type":"_doc","_id":"352ec3eb-5f7e-b717-e551-869fe28d9000","status":409,"error":{"type":"version_conflict_engine_exception","reason":"[352ec3eb-5f7e-b717-e551-869fe28d9000]: version conflict, document already exists (current version [1])","index_uuid":"tHK-VJNtQ1uPUZIqwLOBbQ","shard":"0","index":"ks-logstash-log-2023.05.31"}}},{"create":{"_index":"ks-logstash-log-2023.05.31","_type":"_doc","_id":"158e9edd-ce0f-defe-7759-82b1c850ce35","status":409,"error":{"type":"version_conflict_engine_exception","reason":"[158e9edd-ce0f-defe-7759-82b1c850ce35]: version conflict, document already exists (current version [1])","index_uuid":"tHK-VJNtQ1uPUZIqwLOBbQ","shard":"0","index":"ks-logstash-log-2023.05.31"}}},{"create":{"_index":"ks-logstash-log-2023.05.31","_type":"_doc","_id":"81bfb1ab-eedf-a1e4-4576-9d37b26a7243","status":409,"error":{"type":"version_conflict_engine_exception","reason":"[81bfb1ab-eedf-a1e4-4576-9d37b26a7243]: version conflict, document already exists (current version [1])","index_uuid":"tHK-VJNtQ1uPUZIqwLOBbQ","shard":"0","index":"ks-logstash-log-2023.05.31"}}},{"create":{"_index":"ks-logstash-log-2023.05.31","_type":"_doc","_id":"d6e459f9-912f-1b53-f1cb-2e06c71b1572","status":409,"error":{"type":"version_conflict_engine_exception","reason":"[d6e459f9-912f-1b53-f1cb-2e06c71b1572]: version conflict, document already exists (current version [1])","index_uuid":"tHK-VJNtQ1uPUZIqwLOBbQ","shard":"0","index":"ks-logstash-log-2023.05.31"}}},{"create":{"_index":"ks-logstash-log-2023.05.31","_type":"_doc","_id":"161aa133-3be1-bf7a-bd80-2e35fcbb9a97","status":409,"error":{"type":"version_conflict_engine_exception","reason":"[161aa133-3be1-bf7a-bd80-2e35fcbb9a97]: version conflict, document already exists (current version [1])","index_uuid":"tHK-VJNtQ1uPUZIqwLOBbQ","shard":"0","index":"ks-logstash-log-2023.05.31"}}},{"create":{"_index":"ks-logstash-log-2023.05.31","_type":"_doc","_id":"70f7a746-795f-13de-f9b7-4892c257a150","status":409,"error":{"type":"version_conflict_engine_exception","reason":"[70f7a746-795f-13de-f9b7-4892c257a150]: version conflict, document already exists (current version [1])","index_uuid":"tHK-VJNtQ1uPUZIqwLOBbQ","shard":"0","index":"ks-logstash-log-2023.05.31"}}},{"create":{"_index":"ks-logstash-log-2023.05.31","_type":"_doc","_id":"02955f98-5a43-9aa8-281d-a85568bc9cd3","status":409,"error":{"type":"version_conflict_engine_exception","reason":"[02955f98-5a43-9aa8-281d-a85568bc9cd3]: version conflict, document already exists (current version [1])","index_uuid":"tHK-VJNtQ1uPUZIqwLOBbQ","shard":"0","index":"ks-logstash-log-2023.05.31"}}},{"create":{"_index":"ks-logstash-log-2023.05.31","_type":"_doc","_id":"fa9596d8-107f-8c5d-2640-9cd9a52748e4","status":409,"error":{"type":"version_conflict_engine_exception","reason":"[fa9596d8-107f-8c5d-2640-9cd9a52748e4]: version conflict, document already exists (current version [1])","index_uuid":"tHK-VJNtQ1uPUZIqwLOBbQ","shard":"0","index":"ks-logstash-log-2023.05.31"}}},{"create":{"_index":"ks-logstash-log-2023.05.31","_type":"_doc","_id":"5357384b-7e7d-9f87-ed48-92f95beaa416","status":409,"error":{"type":"version_conflict_engine_exception","reason":"[5357384b-7e7d-9f87-ed48-92f95beaa416]: version conflict, document already exists (current version [1])","index_uuid":"tHK-VJNtQ1uPUZIqwLOBbQ","shard":"0","index":"ks-logstash-log-2023.05.31"}}},{"create":{"_index":"ks-logstash-log-2023.05.31","_type":"_doc","_id":"d0ecfe8e-1ab0-0e05-503d-368e4490bc90","status":409,"error":{"type":"version_conflict_engine_exception","reason":"[d0ecfe8e-1ab0-0e05-503d-368e4490bc90]: version conflict, document already exists (current version [1])","index_uuid":"tHK-VJNtQ1uPUZIqwLOBbQ","shard":"0","index":"ks-logstash-log-2023.05.31"}}},{"create":{"_index":"ks-logstash-log-2023.05.31","_type":"_doc","_id":"8a6d0ed9-ee9d-ee1e-0533-ab1690afa944","status":409,"error":{"type":"version_conflict_engine_exception","

使用kubectl edit cc -n kubesphere-system命令删除过状态然后重启也不行

fluentbit-operator日志

 kind": "FluentBit", "worker count": 1}
2023-06-01T04:24:39.936Z        INFO    controller-runtime.manager.controller.fluentbitconfig   Starting workers        {"reconciler group": "logging.kubesphere.io", "reconciler kind": "FluentBitConfig", "worker count": 1}
2023-06-01T04:26:10.666Z        ERROR   controller-runtime.manager.controller.fluentbitconfig   Reconciler error        {"reconciler group": "logging.kubesphere.io", "reconciler kind": "FluentBitConfig", "name": "containerd", "namespace": "kubesphere-logging-system", "error": "ConfigMap \"fluent-bit-containerd-config\" not found"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.6/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.6/pkg/internal/controller/controller.go:214
2023-06-01T04:26:10.671Z        ERROR   controller-runtime.manager.controller.fluentbitconfig   Reconciler error        {"reconciler group": "logging.kubesphere.io", "reconciler kind": "FluentBitConfig", "name": "containerd", "namespace": "kubesphere-logging-system", "error": "ConfigMap \"fluent-bit-containerd-config\" not found"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.6/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.6/pkg/internal/controller/controller.go:214
2023-06-01T04:26:10.682Z        ERROR   controller-runtime.manager.controller.fluentbitconfig   Reconciler error        {"reconciler group": "logging.kubesphere.io", "reconciler kind": "FluentBitConfig", "name": "containerd", "namespace": "kubesphere-logging-system", "error": "ConfigMap \"fluent-bit-containerd-config\" not found"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.6/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.6/pkg/internal/controller/controller.go:214
2023-06-01T04:26:10.702Z        ERROR   controller-runtime.manager.controller.fluentbitconfig   Reconciler error        {"reconciler group": "logging.kubesphere.io", "reconciler kind": "FluentBitConfig", "name": "containerd", "namespace": "kubesphere-logging-system", "error": "ConfigMap \"fluent-bit-containerd-config\" not found"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.6/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.6/pkg/internal/controller/controller.go:214
2023-06-01T04:26:10.742Z        ERROR   controller-runtime.manager.controller.fluentbitconfig   Reconciler error        {"reconciler group": "logging.kubesphere.io", "reconciler kind": "FluentBitConfig", "name": "containerd", "namespace": "kubesphere-logging-system", "error": "ConfigMap \"fluent-bit-containerd-config\" not found"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.6/pkg/internal/controller/controller.go:253
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.9.6/pkg/internal/controller/controller.go:214

按照官网文档卸载重装也不行：

https://www.kubesphere.io/zh/docs/v3.3/pluggable-components/uninstall-pluggable-components/