Flume介绍、框架、安装、及案例1、2、3

概述
日志采集工具----可靠性机制、故障转移和恢复机制，容错能力。可扩展数据模型，允许在线分析应用程序。

为什么需要flume？
数据从哪里来？
-》爬虫
-》日志数据 flume
—》传统型数据库 sqoop

flume架构
source:数据源
产生数据流，同时source将产生的数据流传输到channel
channel:传输通道
用于桥接source和sinks
sinks:槽
从channel端收集数据
event:传输单元
Flume数据传输的基本单元，以事件的形式将数据送往目的地。

flume安装
mv flume-env.sh.template flume-env.sh
export JAVA_HOME=

案例1–监听端口
a1.sources = r1
a1.sinks = k1
a1.channels = c1

a1.sources.r1.type = netcat
a1.sources.r1.bind = bigdata
a1.sources.r1.port = 44444

a1.sinks.k1.type = logger

a1.channels.c1.type = memory
a1.channels.c1.capacity = 1000
a1.channels.c1.transactionCapacity = 100

a1.sources.r1.channels = c1
a1.sinks.k1.channel = c1

bin/flume-ng agent --conf conf/ --name a1 --conf-file conf/text.conf -Dflume.root.logger==INFO,console

telnet bigdata 44444

案例2–监听文件
a1.sources = r1
a1.sinks = k1
a1.channels = c1

#exec执行一个命令的方式去查看文件 tail -F实时查看
a1.sources.r1.type = exec
#要执行的脚本commond tail -F 默认10行 man tail 查看帮助
a1.sources.r1.command = tail -F /root/logs/test.log
#执行这个command使用的是那个脚本 -C 制定使用什么命令
#whereis bash，执行命令查看bash的地址
a1.sources.r1.shell = /usr/bin/bash -c

a1.sinks.k1.type = hdfs
a1.sinks.k1.hdfs.path = hdfs://bigdata:9000/flume/%Y%m%d/%H
#上传文件的前缀
a1.sinks.k1.hdfs.filePrefix = logs-
#是否按照时间滚动文件夹
a1.sinks.k1.hdfs.round = true
#多少时间单位创建一个新的文件夹 秒 （默认30s）
a1.sinks.k1.hdfs.roundValue = 1
#重新定义事件单位（每分钟滚动一个文件夹）
a1.sinks.k1.hdfs.roundUnit = minute
#是否使用本地时间戳
a1.sinks.k1.hdfs.useLoaclTimeStamp = true
#积攒多少个Event才flush到HDFS一次
a1.sinks.k1.hdfs.batchSize = 1000
#设置文件类型，可支持压缩
a1.sinks.k1.hdfs.fileType = DataStream
#多久生成一个新的文件 秒
a1.sinks.k1.hdfs.rollInterval = 30
#设置每个文件的滚动大小 字节（最好128M）
a1.sinks.k1.hdfs.rollSize = 13421770
#文件的滚动与Event数量围观
a1.sinks.k1.hdfs.rollCount = 0
#最小冗余数（备份数，生成滚动功能则生效roll hadoop本身有此功能 无需配置） 1份 不用设置，
a1.sinks.k1.hdfs.minBlockReplicas = 1


a1.channels.c1.type = memory
a1.channels.c1.capacity = 1000
a1.channels.c1.transactionCapacity = 100

a1.sources.r1.channels = c1
a1.sinks.k1.channel = c1

案例3–监听文件夹
# 定义
a1.sources = r1
a1.sinks = k1
a1.channels = c1

# Describe/configure the source
a1.sources.r1.type = spooldir
# 监控的文件夹
a1.sources.r1.spoolDir = /root/spooldir
# 上传成功后显示后缀名 
a1.sources.r1.fileSuffix = .COMPLETED
# 如论如何 加绝对路径的文件名 默认false
a1.sources.r1.fileHeader = true

#忽略所有以.tmp 结尾的文件（正在被写入），不上传
# ^以任何开头 出现无限次 以.tmp结尾的
a1.sources.r1.ignorePattern = ([^ ]*\.tmp)

# Describe the sink 
a1.sinks.k1.type = hdfs
a1.sinks.k1.hdfs.path = hdfs://bigdata:9000/flume/spooldir/%Y%m%d/%H
#上传文件的前缀
a1.sinks.k1.hdfs.filePrefix = spooldir-
#是否按照时间滚动文件夹
a1.sinks.k1.hdfs.round = true
#多少时间单位创建一个新的文件夹
a1.sinks.k1.hdfs.roundValue = 1
#重新定义时间单位
a1.sinks.k1.hdfs.roundUnit = hour
#是否使用本地时间戳
a1.sinks.k1.hdfs.useLocalTimeStamp = true
#积攒多少个 Event 才 flush 到 HDFS 一次
a1.sinks.k1.hdfs.batchSize = 50

#设置文件类型，可支持压缩
a1.sinks.k1.hdfs.fileType = DataStream
#多久生成一个新的文件
a1.sinks.k1.hdfs.rollInterval = 600
#设置每个文件的滚动大小大概是 128M 
a1.sinks.k1.hdfs.rollSize = 134217700
#文件的滚动与 Event 数量无关
a1.sinks.k1.hdfs.rollCount = 0
#最小副本数
a1.sinks.k1.hdfs.minBlockReplicas = 1

# Use a channel which buffers events in memory 
a1.channels.c1.type = memory 
a1.channels.c1.capacity = 1000
a1.channels.c1.transactionCapacity = 100

# Bind the source and sink to the channel
a1.sources.r1.channels = c1 
a1.sinks.k1.channel = c1

案例4----多channels，多sinks
需求:监控hive.log文件，同时产生两个Channel，一个channel对应的sink存储到hdfs中，另外一个channel对应的sink存储到本地中

# name the components on this agent 
a1.sources = r1
a1.sinks = k1 k2 
a1.channels = c1 c2
# 将数据流复制给多个 channel
a1.sources.r1.selector.type = replicating

# Describe/configure the source 
a1.sources.r1.type = exec
a1.sources.r1.command = tail -F /tmp/root/hive.log
a1.sources.r1.shell = /bin/bash -c


# Describe the sink
# 分两个端口发送数据 
a1.sinks.k1.type = avro 
a1.sinks.k1.hostname = hd09-01 
a1.sinks.k1.port = 4141

a1.sinks.k2.type = avro 
a1.sinks.k2.hostname = hd09-01 
a1.sinks.k2.port = 4142

# Describe the channel 
a1.channels.c1.type = memory 
a1.channels.c1.capacity = 1000
a1.channels.c1.transactionCapacity = 100

a1.channels.c2.type = memory 
a1.channels.c2.capacity = 1000
a1.channels.c2.transactionCapacity = 100

# Bind the source and sink to the channel 
a1.sources.r1.channels = c1 c2 
a1.sinks.k1.channel = c1
a1.sinks.k2.channel = c2


# Name the components on this agent 
a2.sources = r1
a2.sinks = k1 
a2.channels = c1

# Describe/configure the source
a2.sources.r1.type = avro 
# 端口抓取数据
a2.sources.r1.bind = hd09-01
a2.sources.r1.port = 4141

# Describe the sink 
a2.sinks.k1.type = hdfs
a2.sinks.k1.hdfs.path = hdfs://hd09-01:9000/flume2/%Y%m%d/%H

#上传文件的前缀
a2.sinks.k1.hdfs.filePrefix = flume2-
#是否按照时间滚动文件夹
a2.sinks.k1.hdfs.round = true
#多少时间单位创建一个新的文件夹
a2.sinks.k1.hdfs.roundValue = 1
#重新定义时间单位
a2.sinks.k1.hdfs.roundUnit = hour
#是否使用本地时间戳
a2.sinks.k1.hdfs.useLocalTimeStamp = true
#积攒多少个 Event 才 flush 到 HDFS 一次
a2.sinks.k1.hdfs.batchSize = 100

#设置文件类型，可支持压缩
a2.sinks.k1.hdfs.fileType = DataStream
#多久生成一个新的文件
a2.sinks.k1.hdfs.rollInterval = 600
#设置每个文件的滚动大小大概是 128M 
a2.sinks.k1.hdfs.rollSize = 134217700
#文件的滚动与 Event 数量无关
a2.sinks.k1.hdfs.rollCount = 0
#最小副本数
a2.sinks.k1.hdfs.minBlockReplicas = 1

# Describe the channel 
a2.channels.c1.type = memory 
a2.channels.c1.capacity = 1000
a2.channels.c1.transactionCapacity = 100

# Bind the source and sink to the channel 
a2.sources.r1.channels = c1
a2.sinks.k1.channel = c1




# Name the components on this agent 
a3.sources = r1
a3.sinks = k1 
a3.channels = c1

# Describe/configure the source 
a3.sources.r1.type = avro
a3.sources.r1.bind = hd09-01
a3.sources.r1.port = 4142

# Describe the sink 
a3.sinks.k1.type = file_roll
a3.sinks.k1.sink.directory = /root/flume2

# Describe the channel 
a3.channels.c1.type = memory 
a3.channels.c1.capacity = 1000
a3.channels.c1.transactionCapacity = 100


# Bind the source and sink to the channel 
a3.sources.r1.channels = c1
a3.sinks.k1.channel = c1