ELK不香了？企業(yè)級(jí)日志平臺(tái)后起之秀 Graylog

-? ? ?前言? ? -

當(dāng)我們公司內(nèi)部部署很多服務(wù)以及測(cè)試、正式環(huán)境的時(shí)候，查看日志就變成了一個(gè)非常剛需的需求了。

#?配置輸入來(lái)源的日志信息
#?我們合理將其配置到了?inputs.d?目錄下的所有?yml?文件
filebeat.config.inputs:
??enabled:?true
??path:?${path.config}/inputs.d/*.yml
??#?若收取日志格式為?json?的?log?請(qǐng)開(kāi)啟此配置
??#?json.keys_under_root:?true

#?配置?Filebeat?需要加載的模塊
filebeat.config.modules:
??path:?${path.config}/modules.d/*.yml
??reload.enabled:?false

setup.template.settings:
??index.number_of_shards:?1

#?配置將日志信息發(fā)送那個(gè)地址上面
output.logstash:
??hosts:?["11.22.33.44:5500"]

#?output.file:
#???enable:?true

processors:
??-?add_host_metadata:?~
??-?rename:
??????fields:
????????-?from:?"log"
??????????to:?"message"
??-?add_fields:
??????target:?""
??????fields:
????????#?加?Token?是為了防止無(wú)認(rèn)證的服務(wù)上?Graylog?服務(wù)發(fā)送數(shù)據(jù)
????????token:?"0uxxxxaM-1111-2222-3333-VQZJxxxxxwgX?"

#?收集的數(shù)據(jù)類(lèi)型
-?type:?log
??enabled:?true
??#?日志文件的路徑地址
??paths:
????-?/var/log/supervisor/app_escape_worker-stderr.log
????-?/var/log/supervisor/app_escape_prod-stderr.log
??symlinks:?true
??#?包含的關(guān)鍵字信息
??include_lines:?["WARNING",?"ERROR"]
??#?打上數(shù)據(jù)標(biāo)簽
??tags:?["app",?"escape",?"test"]
??#?防止程序堆棧信息被分行識(shí)別
??multiline.pattern:?'^\[?[0-9]...{3}'
??multiline.negate:?true
??multiline.match:?after

#?需要配置多個(gè)日志時(shí)可加多個(gè)?type?字段
-?type:?log
??enabled:?true
??......

#?iptables
-?module:?iptables
??log:
????enabled:?true
????var.paths:?["/var/log/iptables.log"]
????var.input:?"file"

#?postgres
-?module:?postgresql
??log:
????enabled:?true
????var.paths:?["/path/to/log/postgres/*.log*"]

#?nginx
-?module:?nginx
??access:
????enabled:?true
????var.paths:?["/path/to/log/nginx/access.log*"]
??error:
????enabled:?true
????var.paths:?["/path/to/log/nginx/error.log*"]

rule?"discard?debug?messages"
when
??to_long($message.level)?>?6
then
??drop_message();
end

#?生成?password_secret?密碼（最少?16?位）
$?sudo?apt?install?-y?pwgen
$?pwgen?-N?1?-s?16
zscMb65...FxR9ag

#?生成后續(xù)?Web?登錄時(shí)所需要使用的密碼
$?echo?-n?"Enter?Password:?"?&&?head?-1?'\n'?|?sha256sum?|?cut?-d"?"?-f1
Enter?Password:?zscMb65...FxR9ag
77e29e0f...557515f

version:?"3"

services:
??mongo:
????restart:?on-failure
????container_name:?graylog_mongo
????image:?"mongo:3"
????volumes:
??????-?"./mongodb:/data/db"
????networks:
??????-?graylog_network

??elasticsearch:
????restart:?on-failure
????container_name:?graylog_es
????image:?"elasticsearch:6.8.5"
????volumes:
??????-?"./es_data:/usr/share/elasticsearch/data"
????environment:
??????-?http.host=0.0.0.0
??????-?transport.host=localhost
??????-?network.host=0.0.0.0
??????-?"ES_JAVA_OPTS=-Xms512m?-Xmx5120m"
????ulimits:
??????memlock:
????????soft:?-1
????????hard:?-1
????deploy:
??????resources:
????????limits:
??????????memory:?12g
????networks:
??????-?graylog_network

??graylog:
????restart:?on-failure
????container_name:?graylog_web
????image:?"graylog/graylog:3.3"
????ports:
??????-?9000:9000?#?Web?服務(wù)提供的訪(fǎng)問(wèn)端口
??????-?5044:5044?#?Filebeat?工具提供端口
??????-?12201:12201?#?GELF?TCP
??????-?12201:12201/udp?#?GELF?UDP
??????-?1514:1514?#?Syslog?TCP
??????-?1514:1514/udp?#?Syslog?UDP
????volumes:
??????-?"./graylog_journal:/usr/share/graylog/data/journal"
????environment:
??????-?GRAYLOG_PASSWORD_SECRET=zscMb65...FxR9ag
??????-?GRAYLOG_ROOT_PASSWORD_SHA2=77e29e0f...557515f
??????-?GRAYLOG_HTTP_EXTERNAL_URI=http://11.22.33.44:9000/
??????-?GRAYLOG_TIMEZONE=Asia/Shanghai
??????-?GRAYLOG_ROOT_TIMEZONE=Asia/Shanghai
????networks:
??????-?graylog
????depends_on:
??????-?mongo
??????-?elasticsearch

networks:
??graylog_network:
????driver:?bridge

作者：Escape

來(lái)源：escapelife.site/posts/38c81b25.html