服务部署发展

传统架构单应用部署

应用程序部署在单节点中，日志资源同样输出到这台单节点物理机的存储介质中。

微服务架构服务部署

以分布式，集群的方式部署应用，应用分别部署在不同的物理机中，日志分别输出到应用部署的那台物理机中。

K8S部署微服务

应用以docker容器的方式部署在K8S平台中，应用日志输出到K8S的各个Pod节点中。

系统架构

Elasticsearch

分布式搜索和分析引擎。聚合和丰富您的数据并将其存储在Elasticsearch中。elasticsearch负责存储日志和处理查询。

logstash

实时流水线功能的开源数据收集引擎。可以动态统一来自不同来源的数据。logstash负责收集日志，整理日志并将日志发送至Elasticsearch中保存。

kibana

开源分析和可视化平台。kibana用于UI展示。

filebeat

转发和集中日志数据的轻量级中转程序。收集您指定的日志并转发到指定的位置。filebeat负责收集日志并将日志转送至您指定的位置。

部署ELK

编写docker-compose

version: '2'

services:

  elasticsearch:

    container_name: elasticsearch

    image: docker.elastic.co/elasticsearch/elasticsearch:7.8.1

    ports:

      - "9200:9200"

    volumes:

      - /mydata/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml

      - /mydata/elasticsearch/data:/usr/share/elasticsearch/data

      - /mydata/elasticsearch/plugins:/usr/share/elasticsearch/plugins

    environment:

      - "ES_JAVA_OPTS=-Xms1024m -Xmx1024m"

      - "discovery.type=single-node"

      - "COMPOSE_PROJECT_NAME=elasticsearch-server"

    restart: 'no'

  kibana:

    depends_on:

      - elasticsearch

    container_name: kibana

    image: docker.elastic.co/kibana/kibana:7.8.1

    ports:

      - "5601:5601"

    restart: 'no'

    environment:

      - ELASTICSEARCH_HOSTS=http://192.168.1.20:9200

  filebeat:

    container_name: filebeat

    image: docker.elastic.co/beats/filebeat:7.8.1

    user: root

    volumes:

      - /home/chinda/log:/var/log

      - /mydata/filebeat/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro

      - /var/lib/docker/containers:/var/lib/docker/containers:ro

      - /var/run/docker.sock:/var/run/docker.sock:ro

    command: filebeat -e -strict.perms=false

  logstash:

    container_name: logstash

    image: docker.elastic.co/logstash/logstash:7.8.1

    ports:

      - 5044:5044

    restart: 'no'

    volumes:

      - /mydata/logstash/pipeline/logstash.conf:/usr/share/logstash/pipeline/logstash.conf

      - /mydata/logstash/settings/logstash.yml:/usr/share/logstash/settings/logstash.yml

    command: bin/logstash --config.reload.automatic --http.port 9600

配置filebeat

filebeat.inputs:

  - type: log

    multiline:

      pattern: '^\d{4}-\d{2}-\d{2}'

      negate: true

      match: after

    tags: ['chinda']

    fields:

      app_id: chinda_app

    exclude_lines: ['^DBG']

    paths:

      - /var/log/*/*.log

output.logstash:

  hosts: ["192.168.1.20:5044"]

配置logstash

# The # character at the beginning of a line indicates a comment. Use

# comments to describe your configuration.

input {

    beats {

        port => "5044"

    }

}

# The filter part of this file is commented out to indicate that it is

# optional.

filter {

    grok {

        match => { "message" => "%{TIMESTAMP_ISO8601:log_date}\s*%{LOGLEVEL:log_level}\s*%{POSINT}\s*---\s*\[%{GREEDYDATA}\]\s*%{JAVAFILE:log_class}(.*?[:])\s*(?<log_content>.*$)" }

    }

    date {

        timezone => "Asia/Shanghai"

        match => [ "log_date", "yyyy-MM-dd HH:mm:ss.SSS" ]

    }

}

output {

    elasticsearch {

        hosts => [ "192.168.1.20:9200" ]

        index => "chinda_index"

    }

}

注意: grok匹配日志格式为：2020-10-13 14:58:26.801 WARN 25810 --- [o-auto-1-exec-7] com.zaxxer.hikari.pool.PoolBase : HikariPool-1 - Failed to validate connection com.mysql.cj.jdbc.ConnectionImpl@2512a45f (No operations allowed after connection closed.). Possibly consider using a shorter maxLifetime value.

巴特西

Docker(八): 安装ELK