引言

ELK是企业级日志分析解决方案。本文介绍ELK平台的搭建和使用。

一、Elasticsearch安装

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# 下载
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.5.0-linux-x86_64.tar.gz

# 解压
tar -xvf elasticsearch-8.5.0-linux-x86_64.tar.gz

# 配置
vim config/elasticsearch.yml
cluster.name: my-cluster
node.name: node-1
network.host: 0.0.0.0
discovery.type: single-node

# 启动
./bin/elasticsearch

二、Logstash配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
# logstash.conf
input {
  file {
    path => "/var/log/app/*.log"
    start_position => "beginning"
    type => "app-log"
  }
  
  beats {
    port => 5044
  }
}

filter {
  if [type] == "app-log" {
    grok {
      match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:msg}" }
    }
    
    date {
      match => ["timestamp", "ISO8601"]
    }
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "app-logs-%{+YYYY.MM.dd}"
  }
  
  stdout {
    codec => rubydebug
  }
}
1
2
# 启动Logstash
./bin/logstash -f logstash.conf

三、Filebeat配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# filebeat.yml
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/log/app/*.log
    fields:
      app: myapp
      env: production

output.logstash:
  hosts: ["localhost:5044"]

# 或直接输出到ES
output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "filebeat-%{+yyyy.MM.dd}"

四、Kibana配置

1
2
3
4
5
6
7
8
9
10
11
# 下载
wget https://artifacts.elastic.co/downloads/kibana/kibana-8.5.0-linux-x86_64.tar.gz

# 配置
vim config/kibana.yml
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://localhost:9200"]

# 启动
./bin/kibana

五、日志查询

1
2
3
4
5
6
# Kibana查询语法
level: ERROR
status: 500
message: "timeout"
level: ERROR AND status: 500
timestamp: [now-1h TO now]

六、告警配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": ["app-logs-*"],
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "match": {
                    "level": "ERROR"
                  }
                },
                {
                  "range": {
                    "timestamp": {
                      "gte": "now-5m"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 10
      }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "to": "admin@example.com",
        "subject": "Error Alert",
        "body": "Error count exceeded threshold"
      }
    }
  }
}

总结

ELK核心组件：

  1. Elasticsearch：存储和检索
  2. Logstash：日志收集和处理
  3. Kibana：可视化分析
  4. Filebeat：轻量级日志采集

参考资料