kibana图形使用(小节8)

---

highlight: a11y-dark

theme: juejin

kibana 画图功能详解

https://www.elastic.co/guide/cn/kibana/current/introduction.html

Kibana支持多重图从展示功能，需要日志是json格式的支持，具体如新：

web1(106)

软件包：access.log.zip

解压

js cd /usr/local/src/ unzip access.log.zip

追加

js cat access.log >> /var/log/access.log

创建可视化

1. 面积图

2. 饼图

3. 数据表

4. 垂直条形图

5. Markdown

仪表盘

页面共享

1. 固定连接

2. 嵌入代码

安装包：pycharm社区版、安装步骤参考

通过坐标地图统计客户IP所在城市

logstash103

安装包：GeoLite2-City

```js

上传文件后、解压缩

cd /etc/logstash/ tar xf GeoLite2-City_20191015.tar.gz ```

修改配置文件

在input{}和outpat{}中间添加了filter{}(15行信息)

```js vim /etc/logstash/conf.d/redis-to-es.conf input { redis { host => "192.168.37.104" port => "6379" password => "123456" key => "syslog-37-106" data_type => list db => 3 }

redis { host => "192.168.37.104" port => "6379" password => "123456" key => "syslog-37-107" data_type => list db => 3 }

redis { host => "192.168.37.104" port => "6379" password => "123456" key => "nginx-accesslog-37-106" data_type => list db => 3 }

redis { host => "192.168.37.104" port => "6379" password => "123456" key => "nginx-accesslog-37-107" data_type => list db => 3 } }

filter { if [fields][app] == "nginx-106" { geoip { source => "clientip" target => "geoip" #文件路径 database => "/etc/logstash/GeoLite2-City20191015/GeoLite2-City.mmdb" addfield => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ] add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ] } mutate { convert => [ "[geoip][coordinates]", "float"] } } }

output {

系统日志

if [fields][type] == "syslog-106" { elasticsearch { hosts => ["http://192.168.37.102:9200"] index => "filebeat-syslog-37-106-%{+YYYY.MM.dd}" }}

if [fields][type] == "syslog-107" { elasticsearch { hosts => ["http://192.168.37.102:9200"] index => "filebeat-syslog-37-107-%{+YYYY.MM.dd}" }}

nginx日志

if [fields][app] == "nginx-106" { elasticsearch { hosts => ["http://192.168.37.102:9200"] index => "logstash-nginx-accesslog-37-106-%{+YYYY.MM.dd}" }}

if [fields][app] == "nginx-107" { elasticsearch { hosts => ["http://192.168.37.102:9200"] index => "logstash-nginx-accesslog-37-107-%{+YYYY.MM.dd}" }} } ```

停服务

js systemctl stop logstash

检查文件是否报错

js /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/redis-to-es.conf -t

重启服务

js systemctl restart logstash

web1(106)

追加日志

js cat access.log >> /var/log/access.log

刷新一下刷新前

刷新后

添加到仪表盘