在初次使用promtail收集日志时,使用了大量labels
#- job_name: nginx_test
# static_configs:
# - targets:
# - localhost
# labels:
# app: nginx
# env: prod
# host: nginx1
# __path__: /var/log/nginx/access.log
# pipeline_stages:
# - match:
# selector: '{app="nginx"}'
# stages:
# - regex:
# expression: '^(?P<host>[\w\.]+) - (?P<user>[^ ]*) \[(?P<timestamp>.*)\] "(?P<method>[^ ]*) (?P<request_url>[^ ]*) (?P<request_http_protocol>[^ ]*)" (?P<status>[\d]+) (?P<bytes_out>[\d]+) "(?P<http_referer>[^"]*)" "(?P<user_agent>[^"]*)" "(?P<upstream_addr>[^"]*)" "(?P<upstream_response_time>[^"]*)" "(?P<request_time>[^"]*)"?'
# - labels:
# status:
# request_time:
# host:
# user:
# method:
# request_url:
# upstream_addr:
启动后报错
Maximum active stream limit exceeded, reduce the number of active streams
其中labels等字段不应存储为标签,而应使用正则表达式或更优选的模式解析器在查询时将它们提取到标签中。
更改后如下:
#- job_name: nginx_test
# static_configs:
# - targets:
# - localhost
# labels:
# app: nginx
# env: prod
# host: nginx1
# __path__: /var/log/nginx/access.log
# pipeline_stages:
# - match:
# selector: '{app="nginx"}'
# stages:
# - regex:
# expression: '^(?P<host>[\w\.]+) - (?P<user>[^ ]*) \[(?P<timestamp>.*)\] "(?P<method>[^ ]*) (?P<request_url>[^ ]*) (?P<request_http_protocol>[^ ]*)" (?P<status>[\d]+) (?P<bytes_out>[\d]+) "(?P<http_referer>[^"]*)" "(?P<user_agent>[^"]*)" "(?P<upstream_addr>[^"]*)" "(?P<upstream_response_time>[^"]*)" "(?P<request_time>[^"]*)"?'
# - timestamp:
# format: RFC3339Nano
# source: timestamp
重新启动,报错解决