Quick Start ELK
¶Motivation
找个东西收集服务日志,方便结构化搜索,定位异常
¶ELK Elastic Search Logstash Kibana
¶Docker deploy
有个打好的镜像,开箱即用: sebp/elk:8.3.3
这个镜像里已经包括了 ELK,只要run起来就能直接用
¶docker compose example
1 | version: "3" |
¶Disable SSL/TLS
默认配置了ssl,我只是自己浅用一下不想配证书:Disabling SSL/TLS
改一下配置挂进去,覆盖原来的
1 | # filebeat.conf |
很简单的配置:input是beats,端口号5044
¶FileBeats
找个docker imagedocker.elastic.co/beats/filebeat:8.5.2
run起来就能用了。
¶filebeats config
1 | output: |
¶input
¶path
watch file path
¶json
除了配置beats读取文件路径,还要配置json解析来结构化数据
¶output
hosts配置logstash 的 host:port 读环境变量
¶Frequently encountered issues
¶limit mmap counts
Elasticsearch is not starting (1): max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]
update the vm.max_map_count=262144
setting in /etc/sysctl.conf
, then sysctl -p
see: Virtual memory
¶Python Log Format
Customize a logger formatter, reference python-logstash
1 | class LogstashFormatter(logging.Formatter): |
Then use logging.FileHandler with this Formatter, output to a log file, let filebeats collect output stream.
本博客所有文章除特别声明外,均采用 CC BY-NC-SA 4.0 许可协议。转载请注明来自 JMY Space!