如有问题欢迎指出 ,谢谢~
一、添加自定义字段
fields:
type: system
vmId: test123
userId: test123
customerId: test123
fields_under_root: true
效果如下
二、监控数据面板展示
所有查询均为时间区间查询
图表面板查询首先添加filter过滤查询
GET metric*/_search?size=100
{
"query":{
"bool": {
"filter": {
"bool": {
"must":{
"query_string": {
"fields":["beat.name"],
"query": "k8s-fengfan"
}
}
}
}}
}
1、cpu
字段 | 对应图表 |
---|---|
如果system.cpu.cores>0则 (system.cpu.user.pct+system.cpu.system.pct)/system.cpu.cores |
|
按照system.cpu.user.pct排名 beat.name:system.cpu.user.pct |
|
User:system.cpu.user.pct system:system.cpu.system.pct nice:system.cpu.nice.pct irq:system.cpu.irq.pct softirq:system.cpu.softirq.pct iowait:system.cpu.iowait.pct |
|
附录1 | Hosts histogram by CPU usage |
2、load
字段 | 对应图表 |
---|---|
system.load.5 | |
1m:system.load.1 5m:system.load.5 15m:system.load.15 |
3、memory
字段 | 对应图表 |
---|---|
system.memory.actual.used.bytes system.memory.total |
|
system.memory.actual.used.pct 按照system.memory.actual.used.pct排名 beat.name:system.memory.actual.used.pct |
|
system.memory.swap.used.pct | |
Used=system.memory.actual.used.bytes Free=system.momery.free Cache=如果system.memory.actual.used.bytes和system.memory.used.bytes不为空则等于system.memory.actual.used.bytes-system.memory.used.bytes否则为null |
4、process
会生成多条文档(与当前进程数相同,每个进程一条记录)
字段 | 对应图表 |
---|---|
附录2 | |
按照system.process.memory.rss.pct的平均值排名取前10,显示system.process.name:system.process.memory.rss.pct 根据配置文件process.include_top_n.by_memory=10来获取10条记录 |
|
按照system.process.cpu.total.pct的平均值排名取前10,显示system.process.name:system.process.cpu.total.pct 根据配置文件process.include_top_n.by_cpu=10来获取10条记录 |
5、fileSystem
会生成多条文档(每个文件系统一个文档数据)
processors.drop_event.when.regexp.system.filesystem.mount_point=’^/(sys|cgroup|proc|dev|etc|host|lib)($|/)’
过滤了部分数据
字段 | 对应图表 |
---|---|
-system.filesystem.mount_point:/run* AND -system.filesystem.mount_point:/sys* AND -system.filesystem.mount_point:/dev* AND -system.filesystem.mount_point:/proc* AND -system.filesystem.mount_point:/var* AND -system.filesystem.mount_point:/boot的平均值system.filesystem.used.pct |
6、fsstat
会生成多条文档,求平均数
字段 | 对应图表 |
---|---|
system.fsstat.total_size.used不为空且system.fsstat.total_size.tota不为空,则等于system.fsstat.total_size.used/system.fsstat.total_size.tota,否则为null |
附:部分图表查询方式
附录1
请求体
{
"size": 0,
"_source": {
"excludes": []
},
"aggs": {
"2": {
"date_histogram": {
"field": "@timestamp",
"interval": "30s",
"time_zone": "Asia/Shanghai",
"min_doc_count": 1
},
"aggs": {
"3": {
"terms": {
"field": "beat.name",
"size": 20,
"order": {
"1": "desc"
}
},
"aggs": {
"1": {
"avg": {
"field": "system.cpu.user.pct"
}
}
}
}
}
}
},
"version": true,
"stored_fields": [
"*"
],
"script_fields": {
},
"docvalue_fields": [
"@timestamp",
"ceph.monitor_health.last_updated",
"docker.container.created",
"docker.healthcheck.event.end_date",
"docker.healthcheck.event.start_date",
"docker.image.created",
"kubernetes.container.start_time",
"kubernetes.event.metadata.timestamp.created",
"kubernetes.node.start_time",
"kubernetes.pod.start_time",
"kubernetes.system.start_time",
"mongodb.status.background_flushing.last_finished",
"mongodb.status.local_time",
"php_fpm.pool.start_time",
"postgresql.activity.backend_start",
"postgresql.activity.query_start",
"postgresql.activity.state_change",
"postgresql.activity.transaction_start",
"postgresql.bgwriter.stats_reset",
"postgresql.database.stats_reset",
"system.process.cpu.start_time"
],
"query": {
"bool": {
"must": [
{
"query_string": {
"query": "*",
"analyze_wildcard": true,
"default_field": "*"
}
},
{
"query_string": {
"analyze_wildcard": true,
"default_field": "*",
"query": "*"
}
},
{
"range": {
"