![](https://img-blog.csdnimg.cn/20201014180756754.png?x-oss-process=image/resize,m_fixed,h_64,w_64)
ELK
ELK
高大上001
这个作者很懒,什么都没留下…
展开
-
filebeat之input.d下的服务配置
[root@10-110-1-67 ~]# vim /etc/filebeat/input.d/xxxx-server.yml- type: log enabled: true paths: - /data/logs/info.log multiline: pattern: '^\d{4}-\d{2}-\d{2}|^\[\s*[A-Z]*\]\s*\[\d{4}-\d{2}-\d{2}|^[a-zA-Z]+\s+\d{2}\s+\d{2}:\d{2}:\d{2}'...原创 2021-07-31 20:15:15 · 167 阅读 · 0 评论 -
filebeat主配置
[root@10-110-1-67 ~]# vim /etc/filebeat/filebeat.yml#=========================== Filebeat inputs =============================##filebeat.config.inputs: enabled: true path: inputs.d/*.yml#============================= Filebeat modules ============...原创 2021-07-31 20:11:04 · 375 阅读 · 0 评论 -
logstash主配置
[root@localhost logstash]# vim logstash.yml# ------------ Node identity ------------node.name: node-1# ------------ Data path ------------------path.data: /data/logstashpath.logs: /data/logstash/logs#path.config#path.plugins# ------------ Metric.原创 2021-07-31 20:10:07 · 525 阅读 · 0 评论 -
kibana配置
[root@localhost ~]# vim /etc/kibana/kibana.yml# Kibana is served by a back end server. This setting specifies the port to use.server.port: 5601# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid valu.原创 2021-07-31 20:07:22 · 294 阅读 · 0 评论 -
elasticsearch主配置
elasticsearch主配置[root@localhost elasticsearch]# vim elasticsearch.yml# ---------------------------------- Cluster --------------------------------#cluster.name: es-betting-cluster# ---------------------------------- Node ----------------------------原创 2021-07-31 19:12:39 · 175 阅读 · 0 评论 -
es复制索引和数据
elasticsearch 复制索引复制索引:post _reindex{ "source": { "index": "i_alarm_count" }, "dest": { "index": "blog" }}返回值:{"took": 19,"timed_out": false,"total": 9,"updated": 9,"created": 0,"deleted": 0,"batches": 1,"version_confli...原创 2021-07-24 21:30:52 · 2216 阅读 · 0 评论 -
es之_update按条件更新
一、更新文档原理: 检索并修改它,然后重新索引整个文档1.从旧文档构建 JSON2.更改该 JSON3.删除旧文档4.索引一个新文档二、部分更新1. POST cat/tab2/1/_update{ "age":99}三、更新与冲突,在部分更新中,如果更新发生冲突了,我们可以尝试再次更新retry_on_conflict这个参数可以控制再次更新次数,默认是0POST /website/pageviews/1/_update?retry_on_conflict=5{...原创 2021-07-24 21:30:09 · 7648 阅读 · 0 评论 -
es之获取和取消运行的任务
使用Task API获取所有运行的reindex请求的状态:GET _tasks?detailed=true&actions=*reindex根据id直接查找任务:GET /_tasks/taskId:1取消任务POST _tasks/task_id:1/_cancel更改requests_per_second参数的值:POST _reindex/task_id:1/_rethrottle?requests_per_second=-1...原创 2021-07-24 21:29:02 · 6654 阅读 · 0 评论 -
es之_delete_by_query按条件删除数据
POST /account_change_202011/_delete_by_query{ "query": { "bool": { "filter": [ { "terms": { "sn": [ "539786973452701697","539786973410758657" ,"539786973389787137" ,"53978...原创 2021-07-24 21:26:54 · 1361 阅读 · 0 评论 -
es之pipeline给索引加时间戳
步骤:1.创建pipelinePUT _ingest/pipeline/my_timestamp_pipeline{ "description": "Adds a field to a document with the time of ingestion", "processors": [ { "set": { "field": "ingest_timestamp", "value": "{{_ingest.timestamp}}" ...原创 2021-07-24 21:25:36 · 1355 阅读 · 0 评论 -
es常用查询语法
一个完整的select c1,c2,c3,c4..... from tab where .....例子:GET dealer-server-2020.08.20/_search?q=beats_ip:10.111.8.142&filter_path=hits.hits._source&_source_includes=beats_ip,myindex_date,trace_id分解:GET dealer-server-2020.08.20/_search?q=beats_...原创 2021-07-24 21:23:52 · 249 阅读 · 0 评论 -
es常用运维文档
==============================1.查看是否有UNASSIGNED====================================查看索引分布在哪些节点上,查看主分片、副本分片分布在哪些节点上GET _cat/shards?v===========================================================================2.查看索引健康状态,查看索引主分片数、副本分片数,查看文档数,删除文档数,查看.原创 2021-07-24 21:23:02 · 596 阅读 · 0 评论 -
Filebeat主配置详解
Filebeat主配置详解filebeat.inputs:# 日志类型- type: logfields:# 用于后面的识别判断log_source: ip# 是否实时读取enabled: true# 日志文件位置paths:-D:\program\php\a.log# 日志文件中包含id数据进行收集 include_lines: ['id'] # 多长时间去检测新的文件生成的时间 ,默认...原创 2021-07-24 21:21:43 · 1584 阅读 · 0 评论 -
filebeat历史数据采集
filebeat采集历史日志1.可以采集当前日志文件的历史日志2.可以添加新的日志路径,如采集其它的历史日志文件- type: log ignore_older: 2h ##这个可以采集当前日志文件2小时内的日志,(2h/2m时分) enabled: true paths: - /data/jvmapp/dt-server-auto-dealer/logs/info.log - /data/jvmapp/dt-server-auto-de...原创 2021-07-24 21:20:48 · 720 阅读 · 0 评论 -
ELK组件YUM安装
ELK软件安装:YUM安装YUM源配置:rpm --import https://packages.elastic.co/GPG-KEY-elasticsearchcat > /etc/yum.repos.d/elk.repo << EOF[elastic-7.x]name=Elastic repository for 7.x packagesbaseurl=https://artifacts.elastic.co/packages/7.x/yumgpgcheck=1g原创 2021-07-24 21:16:23 · 290 阅读 · 0 评论