想要2个功能:
1,日志报表发邮件
2,日志报警
测了老半天测的吐血.
1.安装过程--遇到的问题
先装es再装kibana
再在es目录安装x-pack()
kibana里面安装x-pack
在elasticsearch.yml中设置xpack.security.enabled: false
重启es
重启kibana
访问IP:9200，正常，告诉我去搜索。
访问IP:5601，页面不展示，浏览器上说重定向过多，
依据官网也在kibana.yml中配置了xpack.security.enabled: false，
访问kibana没数据
elk安装(http://bbotte.blog.51cto.com/6205307/1613571)
2,查看索引
curl 'http://192.168.14.134:9200/_search?pretty'
3,安装xpack
./elasticsearch/bin/elasticsearch-plugin install file:///usr/local/x-pack-5.2.0.zip
./kibana/bin/kibana-plugin install file:///usr/local/x-pack-5.2.0.zip
./logstash/bin/logstash-plugin install file:///usr/local/x-pack-5.2.0.zip
xpack安装(https://www.elastic.co/guide/en/x-pack/current/installing-xpack.html)
xpack(破解,仅5.2版本)(http://blog.csdn.net/mvpboss1004/article/details/65445023)
注意:最新的5.4破解不好用.
licence得自己申请后改
{"license":{"uid":"7c05f405-6c40-4acb-b2e3-f60e3bd589b4","type":"basic","issue_date_in_millis":1496620800000,"expiry_date_in_millis":1528243199999,"max_nodes":100,"issued_to":"lanny ma (tt100)","issuer":"Web Form","signature":"AAAAAwAAAA2DOwdPxO9fkXfph+U4AAABmC9ZN0hjZDBGYnVyRXpCOW5Bb3FjZDAxOWpSbTVoMVZwUzRxVk1PSmkxaktJRVl5MUYvUWh3bHZVUTllbXNPbzBUemtnbWpBbmlWRmRZb25KNFlBR2x0TXc2K2p1Y1VtMG1UQU9TRGZVSGRwaEJGUjE3bXd3LzRqZ05iLzRteWFNekdxRGpIYlFwYkJiNUs0U1hTVlJKNVlXekMrSlVUdFIvV0FNeWdOYnlESDc3MWhlY3hSQmdKSjJ2ZTcvYlBFOHhPQlV3ZHdDQ0tHcG5uOElCaDJ4K1hob29xSG85N0kvTWV3THhlQk9NL01VMFRjNDZpZEVXeUtUMXIyMlIveFpJUkk2WUdveEZaME9XWitGUi9WNTZVQW1FMG1DenhZU0ZmeXlZakVEMjZFT2NvOWxpZGlqVmlHNC8rWVVUYzMwRGVySHpIdURzKzFiRDl4TmM1TUp2VTBOUlJZUlAyV0ZVL2kvVk10L0NsbXNFYVZwT3NSU082dFNNa2prQ0ZsclZ4NTltbU1CVE5lR09Bck93V2J1Y3c9PQAAAQBYiKu/XhqFwLgFQOu0N2YgrI7RJ3B7O45qFbVJjfMmHDBMmKb7iEr+IDj5WLxhkvBEKLGLx+nVwdxLWqFSw/4lQNHaErjwx4IB1qzkFV12bhPXjIQrbowpBJNfA+T+SKRWvUiurCVxT1m3HSY9rR8huKFxsR6RG/jOWU3TT6GURwocxxnd8KKkZHhIMkS5c7wh9ZTVNVWmEfBbQPl4tpOiu9qiAwf9k0HQBQBaR/NgcwWhrDc4rK5u/z6YJwQueNjJDdtrAHdC2hWa+LaLYD2wG9uV8ti3sYQl6pNwUd4G9jobE2INFX/+EGIGyOwsp03JdwVrEu9DzNC8e3kNr3y5","start_date_in_millis":1496620800000}}
{"license":{"uid":"helloworld","type":"platinum","issue_date_in_millis":1486598400000,"expiry_date_in_millis":2524579200999,"max_nodes":1000,"issued_to":"helloworld","issuer":"Web Form","signature":"helloworld","start_date_in_millis":1486598400000}
安装licence:
licence.json放到/tmp/licence.json
curl -XPUT -u elastic 'http://SID-HZ-ES1:9200/_xpack/license?acknowledge=true' -d @/tmp/license.json
参考:
https://blog.yourtion.com/install-x-pack-for-elasticsearch-and-kibana.html
输入到es
[root@linux-node1 application]# cat nginx_access.confinput{
file{
path => ["/var/log/nginx/access.log"]
codec => "json"
}
}
output{
elasticsearch{
# username: elastic
# password: changeme
hosts => ["127.0.0.1:9200"]
index => "nginx-www-access-%{+YYYY.MM.dd}"
}
}
#安装nginx并配置日志
yum install nginx -y修改日志
log_format json '{"@timestamp": "$time_iso8601",'
'"@version": "1",'
'"client": "$remote_addr",'
'"url": "$uri", '
'"status": "$status", '
'"domain": "$host", '
'"host": "$server_addr",'
'"size":"$body_bytes_sent", '
'"response_time": "$request_time", '
'"referer": "$http_referer", '
'"http_x_forwarded_for": "$http_x_forwarded_for", '
'"ua": "$http_user_agent" } ';
https://blog.yourtion.com/install-x-pack-for-elasticsearch-and-kibana.html
告警
报警 Alerting
Elasticsearch 中报警功能的实现目前还不算特别智能，这里我们只简单了解一下其工作机制，具体在需要的时候可以根据文档来进行设置。
简单来说，我们需要自己设定触发条件，并指定条件触发之后的动作。一个实际的例子就是，如果发现近十分钟内某个接口一直返回 503 错误，那么就发送邮件通知。分解一下，一个可能的逻辑是：
- Trigger: 每十分钟执行一次
- Input: 对某个 index 进行检索，查询日志中状态为 error 的条目
- Condition: 如果 error 的次数超过 5 次，则认为触发了条件
- Transform: 触发之后会再次进行检索，检索的结果可以被之后的动作访问
- Actions: 执行具体的操作，可以是通知第三方系统或发送邮件等
上面的套路对应到配置文件就是：
|
PUT _xpack/watcher/watch/log_errors
{
"metadata" : {
"color" : "red"
},
"trigger" : {
"schedule" : {
"interval" : "5m"
}
},
"input" : {
"search" : {
"request" : {
"indices" : "log-events",
"body" : {
"size" : 0,
"query" : { "match" : { "status" : "error" } }
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 5 }}
},
"transform" : {
"search" : {
"request" : {
"indices" : "log-events",
"body" : {
"query" : { "match" : { "status" : "error" } }
}
}
}
},
"actions" : {
"my_webhook" : {
"webhook" : {
"method" : "POST",
"host" : "mylisteninghost",
"port" : 9200,
"path" : "/{{watch_id}}",
"body" : "Encountered {{ctx.payload.hits.total}} errors"
}
},
"email_administrator" : {
"email" : {
"to" : "sys.admino@host.domain",
"subject" : "Encountered {{ctx.payload.hits.total}} errors",
"body" : "Too many error in the system, see attached data",
"attachments" : {
"attached_data" : {
"data" : {
"format" : "json"
}
}
},
"priority" : "high"
}
}
}
}
|
以上也可以在 Dev Tools 中的面板中执行试试看。
参考: 写的还不错: http://wdxtub.com/2016/11/19/babel-log-analysis-platform-3/