<kbd id="afajh"><form id="afajh"></form></kbd>
<strong id="afajh"><dl id="afajh"></dl></strong>
    <del id="afajh"><form id="afajh"></form></del>
        1. <th id="afajh"><progress id="afajh"></progress></th>
          <b id="afajh"><abbr id="afajh"></abbr></b>
          <th id="afajh"><progress id="afajh"></progress></th>

          你居然還去服務(wù)器上撈日志,搭個日志收集系統(tǒng)難道不香么!

          共 9638字,需瀏覽 20分鐘

           ·

          2020-06-20 23:46

          ELK日志收集系統(tǒng)進階使用,本文主要講解如何打造一個線上環(huán)境真實可用的日志收集系統(tǒng)。有了它,你就可以和去服務(wù)器上撈日志說再見了!

          ELK環(huán)境安裝

          ELK是指Elasticsearch、Kibana、Logstash這三種服務(wù)搭建的日志收集系統(tǒng),具體搭建方式可以參考《SpringBoot應(yīng)用整合ELK實現(xiàn)日志收集》。這里僅提供最新版本的docker-compose腳本和一些安裝要點。

          docker-compose腳本

          version:?'3'
          services:
          ??elasticsearch:
          ????image:?elasticsearch:6.4.0
          ????container_name:?elasticsearch
          ????environment:
          ??????-?"cluster.name=elasticsearch"?#設(shè)置集群名稱為elasticsearch
          ??????-?"discovery.type=single-node"?#以單一節(jié)點模式啟動
          ??????-?"ES_JAVA_OPTS=-Xms512m?-Xmx512m"?#設(shè)置使用jvm內(nèi)存大小
          ??????-?TZ=Asia/Shanghai
          ????volumes:
          ??????-?/mydata/elasticsearch/plugins:/usr/share/elasticsearch/plugins?#插件文件掛載
          ??????-?/mydata/elasticsearch/data:/usr/share/elasticsearch/data?#數(shù)據(jù)文件掛載
          ????ports:
          ??????-?9200:9200
          ??????-?9300:9300
          ??kibana:
          ????image:?kibana:6.4.0
          ????container_name:?kibana
          ????links:
          ??????-?elasticsearch:es?#可以用es這個域名訪問elasticsearch服務(wù)
          ????depends_on:
          ??????-?elasticsearch?#kibana在elasticsearch啟動之后再啟動
          ????environment:
          ??????-?"elasticsearch.hosts=http://es:9200"?#設(shè)置訪問elasticsearch的地址
          ??????-?TZ=Asia/Shanghai
          ????ports:
          ??????-?5601:5601
          ??logstash:
          ????image:?logstash:6.4.0
          ????container_name:?logstash
          ????environment:
          ??????-?TZ=Asia/Shanghai
          ????volumes:
          ??????-?/mydata/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf?#掛載logstash的配置文件
          ????depends_on:
          ??????-?elasticsearch?#kibana在elasticsearch啟動之后再啟動
          ????links:
          ??????-?elasticsearch:es?#可以用es這個域名訪問elasticsearch服務(wù)
          ????ports:
          ??????-?4560:4560
          ??????-?4561:4561
          ??????-?4562:4562
          ??????-?4563:4563

          安裝要點

          • 使用docker-compose命令運行所有服務(wù):

          docker-compose?up?-d
          • 第一次啟動可能會發(fā)現(xiàn)Elasticsearch無法啟動,那是因為/usr/share/elasticsearch/data目錄沒有訪問權(quán)限,只需要修改/mydata/elasticsearch/data目錄的權(quán)限,再重新啟動;

          chmod?777?/mydata/elasticsearch/data/
          • Logstash需要安裝json_lines插件。

          logstash-plugin?install?logstash-codec-json_lines



          分場景收集日志

          這里為了方便我們查看日志,提出一個分場景收集日志的概念,把日志分為以下四種。

          • 調(diào)試日志:最全日志,包含了應(yīng)用中所有DEBUG級別以上的日志,僅在開發(fā)、測試環(huán)境中開啟收集;

          • 錯誤日志:只包含應(yīng)用中所有ERROR級別的日志,所有環(huán)境只都開啟收集;

          • 業(yè)務(wù)日志:在我們應(yīng)用對應(yīng)包下打印的日志,可用于查看我們自己在應(yīng)用中打印的業(yè)務(wù)日志;

          • 記錄日志:每個接口的訪問記錄,可以用來查看接口執(zhí)行效率,獲取接口訪問參數(shù)。



          Logback配置詳解

          要實現(xiàn)上面的分場景收集日志,主要通過Logback的配置來實現(xiàn),我們先來了解下Logback的配置吧!

          完全配置

          在SpringBoot中,如果我們想要自定義Logback的配置,需要自行編寫logback-spring.xml文件,下面是我們這次要使用的完全配置。



          <configuration>
          ????
          ????<include?resource="org/springframework/boot/logging/logback/defaults.xml"/>
          ????
          ????<include?resource="org/springframework/boot/logging/logback/console-appender.xml"/>
          ????
          ????<springProperty?scope="context"?name="APP_NAME"?source="spring.application.name"?defaultValue="springBoot"/>
          ????
          ????<property?name="LOG_FILE_PATH"?value="${LOG_FILE:-${LOG_PATH:-${LOG_TEMP:-${java.io.tmpdir:-/tmp}}}/logs}"/>
          ????
          ????<springProperty?name="LOG_STASH_HOST"?scope="context"?source="logstash.host"?defaultValue="localhost"/>

          ????
          ????<appender?name="FILE_DEBUG"
          ??????????????class="ch.qos.logback.core.rolling.RollingFileAppender">

          ????????
          ????????<filter?class="ch.qos.logback.classic.filter.ThresholdFilter">
          ????????????<level>DEBUGlevel>
          ????????filter>
          ????????<encoder>
          ????????????
          ????????????<pattern>${FILE_LOG_PATTERN}pattern>
          ????????????<charset>UTF-8charset>
          ????????encoder>
          ????????<rollingPolicy?class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
          ????????????
          ????????????<fileNamePattern>${LOG_FILE_PATH}/debug/${APP_NAME}-%d{yyyy-MM-dd}-%i.logfileNamePattern>
          ????????????
          ????????????<maxFileSize>${LOG_FILE_MAX_SIZE:-10MB}maxFileSize>
          ????????????
          ????????????<maxHistory>${LOG_FILE_MAX_HISTORY:-30}maxHistory>
          ????????rollingPolicy>
          ????appender>

          ????
          ????<appender?name="FILE_ERROR"
          ??????????????class="ch.qos.logback.core.rolling.RollingFileAppender">

          ????????
          ????????<filter?class="ch.qos.logback.classic.filter.LevelFilter">
          ????????????<level>ERRORlevel>
          ????????????<onMatch>ACCEPTonMatch>
          ????????????<onMismatch>DENYonMismatch>
          ????????filter>
          ????????<encoder>
          ????????????
          ????????????<pattern>${FILE_LOG_PATTERN}pattern>
          ????????????<charset>UTF-8charset>
          ????????encoder>
          ????????<rollingPolicy?class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
          ????????????
          ????????????<fileNamePattern>${LOG_FILE_PATH}/error/${APP_NAME}-%d{yyyy-MM-dd}-%i.logfileNamePattern>
          ????????????
          ????????????<maxFileSize>${LOG_FILE_MAX_SIZE:-10MB}maxFileSize>
          ????????????
          ????????????<maxHistory>${LOG_FILE_MAX_HISTORY:-30}maxHistory>
          ????????rollingPolicy>
          ????appender>

          ????
          ????<appender?name="LOG_STASH_DEBUG"?class="net.logstash.logback.appender.LogstashTcpSocketAppender">
          ????????<filter?class="ch.qos.logback.classic.filter.ThresholdFilter">
          ????????????<level>DEBUGlevel>
          ????????filter>
          ????????<destination>${LOG_STASH_HOST}:4560destination>
          ????????<encoder?charset="UTF-8"?class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
          ????????????<providers>
          ????????????????<timestamp>
          ????????????????????<timeZone>Asia/ShanghaitimeZone>
          ????????????????timestamp>
          ????????????????
          ????????????????<pattern>
          ????????????????????<pattern>
          ????????????????????????{
          ????????????????????????"project":?"mall-tiny",
          ????????????????????????"level":?"%level",
          ????????????????????????"service":?"${APP_NAME:-}",
          ????????????????????????"pid":?"${PID:-}",
          ????????????????????????"thread":?"%thread",
          ????????????????????????"class":?"%logger",
          ????????????????????????"message":?"%message",
          ????????????????????????"stack_trace":?"%exception{20}"
          ????????????????????????}
          ????????????????????pattern>
          ????????????????pattern>
          ????????????providers>
          ????????encoder>
          ????????
          ????????<connectionStrategy>
          ????????????<roundRobin>
          ????????????????<connectionTTL>5?minutesconnectionTTL>
          ????????????roundRobin>
          ????????connectionStrategy>
          ????appender>

          ????
          ????<appender?name="LOG_STASH_ERROR"?class="net.logstash.logback.appender.LogstashTcpSocketAppender">
          ????????<filter?class="ch.qos.logback.classic.filter.LevelFilter">
          ????????????<level>ERRORlevel>
          ????????????<onMatch>ACCEPTonMatch>
          ????????????<onMismatch>DENYonMismatch>
          ????????filter>
          ????????<destination>${LOG_STASH_HOST}:4561destination>
          ????????<encoder?charset="UTF-8"?class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
          ????????????<providers>
          ????????????????<timestamp>
          ????????????????????<timeZone>Asia/ShanghaitimeZone>
          ????????????????timestamp>
          ????????????????
          ????????????????<pattern>
          ????????????????????<pattern>
          ????????????????????????{
          ????????????????????????"project":?"mall-tiny",
          ????????????????????????"level":?"%level",
          ????????????????????????"service":?"${APP_NAME:-}",
          ????????????????????????"pid":?"${PID:-}",
          ????????????????????????"thread":?"%thread",
          ????????????????????????"class":?"%logger",
          ????????????????????????"message":?"%message",
          ????????????????????????"stack_trace":?"%exception{20}"
          ????????????????????????}
          ????????????????????pattern>
          ????????????????pattern>
          ????????????providers>
          ????????encoder>
          ????????
          ????????<connectionStrategy>
          ????????????<roundRobin>
          ????????????????<connectionTTL>5?minutesconnectionTTL>
          ????????????roundRobin>
          ????????connectionStrategy>
          ????appender>

          ????
          ????<appender?name="LOG_STASH_BUSINESS"?class="net.logstash.logback.appender.LogstashTcpSocketAppender">
          ????????<destination>${LOG_STASH_HOST}:4562destination>
          ????????<encoder?charset="UTF-8"?class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
          ????????????<providers>
          ????????????????<timestamp>
          ????????????????????<timeZone>Asia/ShanghaitimeZone>
          ????????????????timestamp>
          ????????????????
          ????????????????<pattern>
          ????????????????????<pattern>
          ????????????????????????{
          ????????????????????????"project":?"mall-tiny",
          ????????????????????????"level":?"%level",
          ????????????????????????"service":?"${APP_NAME:-}",
          ????????????????????????"pid":?"${PID:-}",
          ????????????????????????"thread":?"%thread",
          ????????????????????????"class":?"%logger",
          ????????????????????????"message":?"%message",
          ????????????????????????"stack_trace":?"%exception{20}"
          ????????????????????????}
          ????????????????????pattern>
          ????????????????pattern>
          ????????????providers>
          ????????encoder>
          ????????
          ????????<connectionStrategy>
          ????????????<roundRobin>
          ????????????????<connectionTTL>5?minutesconnectionTTL>
          ????????????roundRobin>
          ????????connectionStrategy>
          ????appender>

          ????
          ????<appender?name="LOG_STASH_RECORD"?class="net.logstash.logback.appender.LogstashTcpSocketAppender">
          ????????<destination>${LOG_STASH_HOST}:4563destination>
          ????????<encoder?charset="UTF-8"?class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
          ????????????<providers>
          ????????????????<timestamp>
          ????????????????????<timeZone>Asia/ShanghaitimeZone>
          ????????????????timestamp>
          ????????????????
          ????????????????<pattern>
          ????????????????????<pattern>
          ????????????????????????{
          ????????????????????????"project":?"mall-tiny",
          ????????????????????????"level":?"%level",
          ????????????????????????"service":?"${APP_NAME:-}",
          ????????????????????????"class":?"%logger",
          ????????????????????????"message":?"%message"
          ????????????????????????}
          ????????????????????pattern>
          ????????????????pattern>
          ????????????providers>
          ????????encoder>
          ????????
          ????????<connectionStrategy>
          ????????????<roundRobin>
          ????????????????<connectionTTL>5?minutesconnectionTTL>
          ????????????roundRobin>
          ????????connectionStrategy>
          ????appender>

          ????
          ????<logger?name="org.slf4j"?level="INFO"/>
          ????<logger?name="springfox"?level="INFO"/>
          ????<logger?name="io.swagger"?level="INFO"/>
          ????<logger?name="org.springframework"?level="INFO"/>
          ????<logger?name="org.hibernate.validator"?level="INFO"/>

          ????<root?level="DEBUG">
          ????????<appender-ref?ref="CONSOLE"/>
          ????????
          ????????
          ????????<appender-ref?ref="LOG_STASH_DEBUG"/>
          ????????<appender-ref?ref="LOG_STASH_ERROR"/>
          ????root>

          ????<logger?name="com.macro.mall.tiny.component"?level="DEBUG">
          ????????<appender-ref?ref="LOG_STASH_RECORD"/>
          ????logger>

          ????<logger?name="com.macro.mall"?level="DEBUG">
          ????????<appender-ref?ref="LOG_STASH_BUSINESS"/>
          ????logger>
          configuration>

          配置要點解析

          使用默認的日志配置

          一般我們不需要自定義控制臺輸出,可以采用默認配置,具體配置參考console-appender.xml,該文件在spring-boot-${version}.jar下面。


          <include?resource="org/springframework/boot/logging/logback/defaults.xml"/>

          <include?resource="org/springframework/boot/logging/logback/console-appender.xml"/>

          springProperty

          該標簽可以從SpringBoot的配置文件中獲取配置屬性,比如說在不同環(huán)境下我們的Logstash服務(wù)地址是不一樣的,我們就可以把該地址定義在application.yml來使用。

          例如在application-dev.yml中定義了這些屬性:

          logstash:
          ??host:?localhost

          logback-spring.xml中就可以直接這樣使用:


          <springProperty?scope="context"?name="APP_NAME"?source="spring.application.name"?defaultValue="springBoot"/>

          <springProperty?name="LOG_STASH_HOST"?scope="context"?source="logstash.host"?defaultValue="localhost"/>

          filter

          在Logback中有兩種不同的過濾器,用來過濾日志輸出。

          ThresholdFilter:臨界值過濾器,過濾掉低于指定臨界值的日志,比如下面的配置將過濾掉所有低于INFO級別的日志。

          <filter?class="ch.qos.logback.classic.filter.ThresholdFilter">
          ????<level>INFOlevel>
          filter>

          LevelFilter:級別過濾器,根據(jù)日志級別進行過濾,比如下面的配置將過濾掉所有非ERROR級別的日志。

          <filter?class="ch.qos.logback.classic.filter.LevelFilter">
          ????<level>ERRORlevel>
          ????<onMatch>ACCEPTonMatch>
          ????<onMismatch>DENYonMismatch>
          filter>

          appender

          Appender可以用來控制日志的輸出形式,主要有下面三種。

          • ConsoleAppender:控制日志輸出到控制臺的形式,比如在console-appender.xml中定義的默認控制臺輸出。

          <appender?name="CONSOLE"?class="ch.qos.logback.core.ConsoleAppender">
          ?<encoder>
          ??<pattern>${CONSOLE_LOG_PATTERN}pattern>
          ?encoder>
          appender>
          • RollingFileAppender:控制日志輸出到文件的形式,可以控制日志文件生成策略,比如文件名稱格式、超過多大重新生成文件以及刪除超過多少天的文件。


          <appender?name="FILE_ERROR"
          ??????????class="ch.qos.logback.core.rolling.RollingFileAppender">

          ????<rollingPolicy?class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
          ????????
          ????????<fileNamePattern>${LOG_FILE_PATH}/error/${APP_NAME}-%d{yyyy-MM-dd}-%i.logfileNamePattern>
          ????????
          ????????<maxFileSize>${LOG_FILE_MAX_SIZE:-10MB}maxFileSize>
          ????????
          ????????<maxHistory>${LOG_FILE_MAX_HISTORY:-30}maxHistory>
          ????rollingPolicy>
          appender>
          • LogstashTcpSocketAppender:控制日志輸出到Logstash的形式,可以用來配置Logstash的地址、訪問策略以及日志的格式。


          <appender?name="LOG_STASH_ERROR"?class="net.logstash.logback.appender.LogstashTcpSocketAppender">
          ????<destination>${LOG_STASH_HOST}:4561destination>
          ????<encoder?charset="UTF-8"?class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
          ????????<providers>
          ????????????<timestamp>
          ????????????????<timeZone>Asia/ShanghaitimeZone>
          ????????????timestamp>
          ????????????
          ????????????<pattern>
          ????????????????<pattern>
          ????????????????????{
          ????????????????????"project":?"mall-tiny",
          ????????????????????"level":?"%level",
          ????????????????????"service":?"${APP_NAME:-}",
          ????????????????????"pid":?"${PID:-}",
          ????????????????????"thread":?"%thread",
          ????????????????????"class":?"%logger",
          ????????????????????"message":?"%message",
          ????????????????????"stack_trace":?"%exception{20}"
          ????????????????????}
          ????????????????pattern>
          ????????????pattern>
          ????????providers>
          ????encoder>
          ????
          ????<connectionStrategy>
          ????????<roundRobin>
          ????????????<connectionTTL>5?minutesconnectionTTL>
          ????????roundRobin>
          ????connectionStrategy>
          appender>

          logger

          只有配置到logger節(jié)點上的appender才會被使用,logger用于配置哪種條件下的日志被打印,root是一種特殊的appender,下面介紹下日志劃分的條件。

          • 調(diào)試日志:所有的DEBUG級別以上日志;

          • 錯誤日志:所有的ERROR級別日志;

          • 業(yè)務(wù)日志:com.macro.mall包下的所有DEBUG級別以上日志;

          • 記錄日志:com.macro.mall.tiny.component.WebLogAspect類下所有DEBUG級別以上日志,該類是統(tǒng)計接口訪問信息的AOP切面類。

          控制框架輸出日志

          還有一些使用框架內(nèi)部的日志,DEBUG級別的日志對我們并沒有啥用處,都可以設(shè)置為了INFO以上級別。


          <logger?name="org.slf4j"?level="INFO"/>
          <logger?name="springfox"?level="INFO"/>
          <logger?name="io.swagger"?level="INFO"/>
          <logger?name="org.springframework"?level="INFO"/>
          <logger?name="org.hibernate.validator"?level="INFO"/>



          Logstash配置詳解

          接下來我們需要配置下Logstash,讓它可以分場景收集不同的日志,下面詳細介紹下使用到的配置。

          完全配置

          input {
          tcp {
          mode => "server"
          host => "0.0.0.0"
          port => 4560
          codec => json_lines
          type => "debug"
          }
          tcp {
          mode => "server"
          host => "0.0.0.0"
          port => 4561
          codec => json_lines
          type => "error"
          }
          tcp {
          mode => "server"
          host => "0.0.0.0"
          port => 4562
          codec => json_lines
          type => "business"
          }
          tcp {
          mode => "server"
          host => "0.0.0.0"
          port => 4563
          codec => json_lines
          type => "record"
          }
          }
          filter{
          if [type] == "record" {
          mutate {
          remove_field => "port"
          remove_field => "host"
          remove_field => "@version"
          }
          json {
          source => "message"
          remove_field => ["message"]
          }
          }
          }
          output {
          elasticsearch {
          hosts => ["es:9200"]
          action => "index"
          codec => json
          index => "mall-tiny-%{type}-%{+YYYY.MM.dd}"
          template_name => "mall-tiny"
          }
          }

          配置要點

          • input:使用不同端口收集不同類型的日志,從4560~4563開啟四個端口;

          • filter:對于記錄類型的日志,直接將JSON格式的message轉(zhuǎn)化到source中去,便于搜索查看;

          • output:按類型、時間自定義索引格式。



          SpringBoot配置

          在SpringBoot中的配置可以直接用來覆蓋Logback中的配置,比如logging.level.root就可以覆蓋節(jié)點中的level配置。

          • 開發(fā)環(huán)境配置:application-dev.yml

          logstash:
          ??host:?localhost
          logging:
          ??level:
          ????root:?debug
          • 測試環(huán)境配置:application-test.yml

          logstash:
          ??host:?192.168.3.101
          logging:
          ??level:
          ????root:?debug
          • 生產(chǎn)環(huán)境配置:application-prod.yml

          logstash:
          ??host:?logstash-prod
          logging:
          ??level:
          ????root:?info



          Kibana進階使用

          進過上面ELK環(huán)境的搭建和配置以后,我們的日志收集系統(tǒng)終于可以用起來了,下面介紹下在Kibana中的使用技巧!

          • 首先啟動我們的測試Demo,然后通用調(diào)用接口(可以使用Swagger),產(chǎn)生一些日志信息;

          7340ad51b3a5518a76a3c0cacbb317dc.webp
          • 調(diào)用完成后在Management->Kibana->Index Patterns中可以創(chuàng)建Index Patterns,Kibana服務(wù)訪問地址:http://192.168.3.101:5601

          d5c104cf0f434a9277a5c54a8214cec4.webp
          • 創(chuàng)建完成后可以在Discover中查看所有日志,調(diào)試日志只需直接查看mall-tiny-debug*模式的日志即可;

          a3a32e59f8a2ee93c429c10bcd604b2a.webp
          • 對于日志搜索,kibana有非常強大的提示功能,可以通過搜索欄右側(cè)的Options按鈕打開;

          8666bb8b6bbca72c1928577e39ca67f5.webp
          • 記錄日志只需直接查看mall-tiny-record*模式的日志即可,如果我們想要搜索uri為/brand/listAll的記錄日志,只需在搜索欄中輸入uri : "/brand/listAll";

          7764a48f4aa1017e73f4b340a7cee260.webp
          • 錯誤日志,只需直接查看mall-tiny-error*模式的日志即可;

          6346fc309d3b393032fe5645ed7d5274.webp
          • 業(yè)務(wù)日志,只需直接查看mall-tiny-business*模式的日志即可,這里我們可以查看一些SQL日志的輸出;

          11d1beacd1e00d32c880cf7c4c1f6442.webp
          • 如果日志太大了,可以通過Elasticsearch->Index Management選擇刪除即可。

          a99a182b10917239f4c8204ab688a249.webp



          項目源碼地址

          https://github.com/macrozheng/mall-learning/tree/master/mall-tiny-log


          有道無術(shù),術(shù)可成;有術(shù)無道,止于術(shù)

          歡迎大家關(guān)注Java之道公眾號


          好文章,我在看??

          瀏覽 35
          點贊
          評論
          收藏
          分享

          手機掃一掃分享

          分享
          舉報
          評論
          圖片
          表情
          推薦
          點贊
          評論
          收藏
          分享

          手機掃一掃分享

          分享
          舉報
          <kbd id="afajh"><form id="afajh"></form></kbd>
          <strong id="afajh"><dl id="afajh"></dl></strong>
            <del id="afajh"><form id="afajh"></form></del>
                1. <th id="afajh"><progress id="afajh"></progress></th>
                  <b id="afajh"><abbr id="afajh"></abbr></b>
                  <th id="afajh"><progress id="afajh"></progress></th>
                  欧美成人黄色电影 | 爱操逼逼 | 久久久免费精品国产 | 欧美逼首页 | 国产男女视频网站 |