EFK日志收集
环境 | 解释 | 语言 |
---|---|---|
Elasticsearch | 数据库,存储数据 | java |
logstash | 日志收集,过滤数据 | java |
kibana | 分析,过滤,展示 | java |
filebeat: | 收集日志,传输到ES或logstash | go |
环境
PS:可以多台主机搭建,也可在一台主机上搭建,根据自己实力部署!
主机IP | 主机名 |
---|---|
192.168.1.19 | EFK |
**资源下载地址:**https://mirrors.tuna.tsinghua.edu.cn/elasticstack/6.x/yum/6.6.0/
1. 部署elasticsearch环境
(1)下载elasticsearch包
[root@efk ~]# yum -y install https://mirrors.tuna.tsinghua.edu.cn/elasticstack/6.x/yum/6.6.0/elasticsearch-6.6.0.rpm
(2)创建数据目录,并修改权限
[root@efk ~]# mkdir -p /data/elasticsearch
[root@efk ~]# chown -R elasticsearch.elasticsearch /data/elasticsearch/
(3)修改配置文件
[root@localhost ~]# vim /etc/elasticsearch/elasticsearch.yml
更改:
node.name: node-1 #群集中本机节点名
path.data: /data/elasticsearch #数据目录
path.logs: /var/log/elasticsearch #日志目录
bootstrap.memory_lock: true #锁定内存,需要和/etc/elasticsearch/jvm.options关联
network.host: 192.168.1.19,127.0.0.1 #监听的ip地址
http.port: 9200 #端口号
(4)分配锁定内存
[root@localhost ~]# vim /etc/elasticsearch/jvm.options
更改:
-Xms1g #分配最小内存
-Xmx1g #分配最大内存,官方推荐为物理内存的一半,但最大为32G
(5)修改锁定内存后,无法重启,解决方法如下
[root@localhost ~]# systemctl edit elasticsearch
添加:
[Service]
LimitMEMLOCK=infinity
F2保存退出
[root@localhost ~]# systemctl daemon-reload
[root@localhost ~]# systemctl restart elasticsearch
(6)验证是否部署成功
2.部署Kibana环境
(1)下载Kibana包
[root@efk ~]# yum -y install https://mirrors.tuna.tsinghua.edu.cn/elasticstack/6.x/yum/6.6.0/kibana-6.6.0-x86_64.rpm
(2)修改配置文件,重启服务
[root@efk ~]# vim /etc/kibana/kibana.yml
修改:
server.port: 5601 #修改端口
server.host: "192.168.1.104" #安装kibana主机的IP
server.name: "db01" #自己所在主机的主机名
elasticsearch.hosts: ["http://192.168.1.104:9200"] #es服务器的ip,便于接收日志数据
[root@efk ~]# systemctl start kibana.service
(3)验证是否部署成功
3.部署filebeat环境
filebeat官方文档:
https://www.elastic.co/guide/en/beats/filebeat/current/index.html
(1)下载filebeat包
[root@efk ~]# yum -y install https://mirrors.tuna.tsinghua.edu.cn/elasticstack/6.x/yum/6.6.0/filebeat-6.6.0-x86_64.rpm
(2)修改配置文件,启动filebeat。
[root@efk ~]# vim /etc/filebeat/filebeat.yml
修改:
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/nginx/access.log
output.elasticsearch:
hosts: ["192.168.1.104:9200"] #es服务器的IP
[root@efk ~]# systemctl start filebeat.service
4.案例
PS:使用EFK环境监控NGINX日志
(1)安装nginx,httpd-tools
[root@efk ~]# wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
--2020-08-03 16:41:36-- http://mirrors.aliyun.com/repo/epel-7.repo
正在解析主机 mirrors.aliyun.com (mirrors.aliyun.com)... 113.142.77.246, 27.185.6.238, 124.238.245.204, ...
正在连接 mirrors.aliyun.com (mirrors.aliyun.com)|113.142.77.246|:80... 已连接。
已发出 HTTP 请求,正在等待回应... 200 OK
长度:664 [application/octet-stream]
正在保存至: “/etc/yum.repos.d/epel.repo”
100%[=============================>] 664 --.-K/s 用时 0s
2020-08-03 16:41:37 (140 MB/s) - 已保存 “/etc/yum.repos.d/epel.repo” [664/664])
[root@efk ~]# yum -y install nginx httpd-tools
[root@efk ~]# systemctl start nginx
(2)查看nginx网页
(3)使用ab压力测试工具测试访问
[root@efk ~]# ab -n 100 -c 20 http://192.168.1.19/
This is ApacheBench, Version 2.3 <$Revision: 1430300 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/
Benchmarking 192.168.1.19 (be patient).....done
Server Software: nginx/1.16.1
Server Hostname: 192.168.1.19
Server Port: 80
Document Path: /
Document Length: 4833 bytes
Concurrency Level: 20
Time taken for tests: 0.008 seconds
Complete requests: 100
Failed requests: 0
Write errors: 0
Total transferred: 506800 bytes
HTML transferred: 483300 bytes
Requests per second: 12413.11 [#/sec] (mean)
Time per request: 1.611 [ms] (mean)
Time per request: 0.081 [ms] (mean, across all concurrent requests)
Transfer rate: 61435.19 [Kbytes/sec] received
Connection Times (ms)
min mean[+/-sd] median max
Connect: 0 0 0.2 0 1
Processing: 0 1 0.3 1 1
Waiting: 0 1 0.2 1 1
Total: 1 1 0.3 1 2
Percentage of the requests served within a certain time (ms)
50% 1
66% 1
75% 1
80% 2
90% 2
95% 2
98% 2
99% 2
100% 2 (longest request)
(4)在es浏览器查看filebeat索引和数据
(5)在kibana添加索引
(6)修改nginx的日志格式为json
[root@efk ~]# vim /etc/nginx/nginx.conf
删除:
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
添加在http里:
log_format log_json '{ "@timestamp": "$time_local", '
'"remote_addr": "$remote_addr", '
'"referer": "$http_referer", '
'"request": "$request", '
'"status": $status, '
'"bytes": $body_bytes_sent, '
'"agent": "$http_user_agent", '
'"x_forwarded": "$http_x_forwarded_for", '
'"up_addr": "$upstream_addr",'
'"up_host": "$upstream_http_host",'
'"up_resp_time": "$upstream_response_time",'
'"request_time": "$request_time"'
''}';
[root@efk ~]# systemctl start nginx
清空nginx日志:
[root@efk ~]# vim /var/log/nginx/access.log
使用dd删除全部内容
[root@efk ~]# systemctl restart nginx //更改日志文件日志需要重启以下nginx
ab测试访问,生成json格式日志
[root@efk ~]# cat /var/log/nginx/access.log | wc -l
0
[root@efk ~]# ab -n 100 -c 20 http://192.168.1.19/
......
[root@efk ~]# cat /var/log/nginx/access.log | wc -l
100
查看日志
[root@efk ~]# tail -f /var/log/nginx/access.log
{ "@timestamp": "03/Aug/2020:16:58:49 +0800", "remote_addr": "192.168.1.19", "referer": "-", "request": "GET / HTTP/1.0", "status": 200, "bytes": 4833, "agent": "ApacheBench/2.3", "x_forwarded": "-", "up_addr": "-","up_host": "-","up_resp_time": "-","request_time": "0.000"}
{ "@timestamp": "03/Aug/2020:16:58:49 +0800", "remote_addr": "192.168.1.19", "referer": "-", "request": "GET / HTTP/1.0", "status": 200, "bytes": 4833, "agent": "ApacheBench/2.3", "x_forwarded": "-", "up_addr": "-","up_host": "-","up_resp_time": "-","request_time": "0.000"}
(7)修改filebeat配置文件
[root@efk ~]# vim /etc/filebeat/filebeat.yml
修改为:
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/nginx/access.log
json.keys_under_root: true
json.overwrite_keys: true
output.elasticsearch:
hosts: ["192.168.1.104:9200"]
index: "nginx-%{[beat.version]}-%{+yyyy.MM}"
#以下四列顶头写,不然会出现语法错误
setup.template.name: "nginx"
setup.template.patten: "nginx-*"
setup.template.enabled: false
setup.template.overwrite: true
[root@efk ~]# systemctl restart filebeat
删除红色框起来的
删除创建的filebeat-6.6.0-2020.08.03索引
刷新es网页,会出现刚刚更改配置文件出现的nginx索引
创建新的nginx索引(方法根上面创建的索引一样)
(8)配置access.log和error.log分开
[root@efk ~]# vim /etc/filebeat/filebeat.yml
修改为:
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/nginx/access.log
json.keys_under_root: true
json.overwrite_keys: true
tags: ["access"]
- type: log
enabled: true
paths:
- /var/log/nginx/error.log
tags: ["error"]
output.elasticsearch:
hosts: ["192.168.1.104:9200"]
#index: "nginx-%{[beat.version]}-%{+yyyy.MM}"
indices:
- index: "nginx-access-%{[beat.version]}-%{+yyyy.MM}"
when.contains:
tags: "access"
- index: "nginx-error-%{[beat.version]}-%{+yyyy.MM}"
when.contains:
tags: "error"
setup.template.name: "nginx"
setup.template.patten: "nginx-*"
setup.template.enabled: false
setup.template.overwrite: true
[root@efk ~]# systemctl restart filebeat.service
删除刚才在es页面的nginx索引和在kibana页面创建的索引
刷新es页面会出现nginx成功和失败日志索引
在kibana创建nginx成功 和失败日志索引