Linux——EFK日志收集（Nginx）

EFK日志收集

环境	解释	语言
Elasticsearch	数据库，存储数据	java
logstash	日志收集，过滤数据	java
kibana	分析，过滤，展示	java
filebeat:	收集日志，传输到ES或logstash	go

环境

PS：可以多台主机搭建，也可在一台主机上搭建，根据自己实力部署！

主机IP	主机名
192.168.1.19	EFK

**资源下载地址：**https://mirrors.tuna.tsinghua.edu.cn/elasticstack/6.x/yum/6.6.0/

1. 部署elasticsearch环境

（1）下载elasticsearch包

[root@efk ~]# yum -y install  https://mirrors.tuna.tsinghua.edu.cn/elasticstack/6.x/yum/6.6.0/elasticsearch-6.6.0.rpm

（2）创建数据目录，并修改权限

[root@efk ~]# mkdir -p /data/elasticsearch 
[root@efk ~]# chown -R elasticsearch.elasticsearch /data/elasticsearch/ 

（3）修改配置文件

[root@localhost ~]# vim /etc/elasticsearch/elasticsearch.yml
更改：
node.name: node-1				#群集中本机节点名
path.data: /data/elasticsearch		#数据目录
path.logs: /var/log/elasticsearch	#日志目录
bootstrap.memory_lock: true	#锁定内存，需要和/etc/elasticsearch/jvm.options关联
network.host: 192.168.1.19,127.0.0.1  #监听的ip地址
http.port: 9200	 #端口号

（4）分配锁定内存

[root@localhost ~]# vim /etc/elasticsearch/jvm.options
更改:
-Xms1g		#分配最小内存	
-Xmx1g		#分配最大内存,官方推荐为物理内存的一半，但最大为32G

（5）修改锁定内存后，无法重启，解决方法如下

[root@localhost ~]# systemctl edit elasticsearch
添加：
[Service]
LimitMEMLOCK=infinity
F2保存退出

[root@localhost ~]# systemctl daemon-reload
[root@localhost ~]# systemctl restart elasticsearch

（6）验证是否部署成功

2.部署Kibana环境

（1）下载Kibana包

[root@efk ~]# yum -y install  https://mirrors.tuna.tsinghua.edu.cn/elasticstack/6.x/yum/6.6.0/kibana-6.6.0-x86_64.rpm

（2）修改配置文件，重启服务

扫描二维码关注公众号，回复： 12353240 查看本文章

[root@efk ~]# vim /etc/kibana/kibana.yml
修改：
server.port: 5601    #修改端口
server.host: "192.168.1.104"     #安装kibana主机的IP
server.name: "db01" 	#自己所在主机的主机名
elasticsearch.hosts: ["http://192.168.1.104:9200"]   #es服务器的ip，便于接收日志数据
[root@efk ~]# systemctl  start  kibana.service 

（3）验证是否部署成功

3.部署filebeat环境

filebeat官方文档：

https://www.elastic.co/guide/en/beats/filebeat/current/index.html

（1）下载filebeat包

[root@efk ~]# yum -y install  https://mirrors.tuna.tsinghua.edu.cn/elasticstack/6.x/yum/6.6.0/filebeat-6.6.0-x86_64.rpm 

（2）修改配置文件，启动filebeat。

[root@efk ~]# vim /etc/filebeat/filebeat.yml 
修改：
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/nginx/access.log

output.elasticsearch:
  hosts: ["192.168.1.104:9200"]   #es服务器的IP
[root@efk ~]# systemctl  start filebeat.service 

4.案例

PS：使用EFK环境监控NGINX日志

（1）安装nginx，httpd-tools

[root@efk ~]# wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
--2020-08-03 16:41:36--  http://mirrors.aliyun.com/repo/epel-7.repo
正在解析主机 mirrors.aliyun.com (mirrors.aliyun.com)... 113.142.77.246, 27.185.6.238, 124.238.245.204, ...
正在连接 mirrors.aliyun.com (mirrors.aliyun.com)|113.142.77.246|:80... 已连接。
已发出 HTTP 请求，正在等待回应... 200 OK
长度：664 [application/octet-stream]
正在保存至: “/etc/yum.repos.d/epel.repo”

100%[=============================>] 664         --.-K/s 用时 0s      

2020-08-03 16:41:37 (140 MB/s) - 已保存 “/etc/yum.repos.d/epel.repo” [664/664])
[root@efk ~]# yum -y install nginx httpd-tools
[root@efk ~]# systemctl  start nginx

（2）查看nginx网页

（3）使用ab压力测试工具测试访问

[root@efk ~]# ab -n 100 -c 20 http://192.168.1.19/
This is ApacheBench, Version 2.3 <$Revision: 1430300 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/

Benchmarking 192.168.1.19 (be patient).....done


Server Software:        nginx/1.16.1
Server Hostname:        192.168.1.19
Server Port:            80

Document Path:          /
Document Length:        4833 bytes

Concurrency Level:      20
Time taken for tests:   0.008 seconds
Complete requests:      100
Failed requests:        0
Write errors:           0
Total transferred:      506800 bytes
HTML transferred:       483300 bytes
Requests per second:    12413.11 [#/sec] (mean)
Time per request:       1.611 [ms] (mean)
Time per request:       0.081 [ms] (mean, across all concurrent requests)
Transfer rate:          61435.19 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        0    0   0.2      0       1
Processing:     0    1   0.3      1       1
Waiting:        0    1   0.2      1       1
Total:          1    1   0.3      1       2

Percentage of the requests served within a certain time (ms)
  50%      1
  66%      1
  75%      1
  80%      2
  90%      2
  95%      2
  98%      2
  99%      2
 100%      2 (longest request)

（4）在es浏览器查看filebeat索引和数据

（5）在kibana添加索引

（6）修改nginx的日志格式为json

[root@efk ~]# vim /etc/nginx/nginx.conf
删除：
log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;
添加在http里：

         log_format log_json '{ "@timestamp": "$time_local", '
                '"remote_addr": "$remote_addr", '
                '"referer": "$http_referer", '
                '"request": "$request", '
                '"status": $status, '
                '"bytes": $body_bytes_sent, '
                '"agent": "$http_user_agent", '
                '"x_forwarded": "$http_x_forwarded_for", '
                '"up_addr": "$upstream_addr",'
                '"up_host": "$upstream_http_host",'
                '"up_resp_time": "$upstream_response_time",'
                '"request_time": "$request_time"'
                ''}';
[root@efk ~]# systemctl  start nginx                

清空nginx日志：

[root@efk ~]# vim /var/log/nginx/access.log 
使用dd删除全部内容
[root@efk ~]# systemctl restart nginx  //更改日志文件日志需要重启以下nginx

ab测试访问，生成json格式日志

[root@efk ~]# cat /var/log/nginx/access.log | wc -l
0
[root@efk ~]# ab -n 100 -c 20 http://192.168.1.19/
......
[root@efk ~]# cat /var/log/nginx/access.log | wc -l
100

查看日志

[root@efk ~]# tail -f /var/log/nginx/access.log 
{ "@timestamp": "03/Aug/2020:16:58:49 +0800", "remote_addr": "192.168.1.19", "referer": "-", "request": "GET / HTTP/1.0", "status": 200, "bytes": 4833, "agent": "ApacheBench/2.3", "x_forwarded": "-", "up_addr": "-","up_host": "-","up_resp_time": "-","request_time": "0.000"}
{ "@timestamp": "03/Aug/2020:16:58:49 +0800", "remote_addr": "192.168.1.19", "referer": "-", "request": "GET / HTTP/1.0", "status": 200, "bytes": 4833, "agent": "ApacheBench/2.3", "x_forwarded": "-", "up_addr": "-","up_host": "-","up_resp_time": "-","request_time": "0.000"}

（7）修改filebeat配置文件

[root@efk ~]# vim /etc/filebeat/filebeat.yml
修改为：
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/nginx/access.log
  json.keys_under_root: true
  json.overwrite_keys: true

output.elasticsearch:
  hosts: ["192.168.1.104:9200"]
  index: "nginx-%{[beat.version]}-%{+yyyy.MM}"
#以下四列顶头写，不然会出现语法错误
setup.template.name: "nginx"  
setup.template.patten: "nginx-*"
setup.template.enabled: false
setup.template.overwrite: true
[root@efk ~]# systemctl restart filebeat

删除红色框起来的

删除创建的filebeat-6.6.0-2020.08.03索引

刷新es网页，会出现刚刚更改配置文件出现的nginx索引

创建新的nginx索引（方法根上面创建的索引一样）

（8）配置access.log和error.log分开

[root@efk ~]#  vim /etc/filebeat/filebeat.yml
修改为：
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/nginx/access.log
  json.keys_under_root: true
  json.overwrite_keys: true
  tags: ["access"]
  
- type: log
  enabled: true
  paths:
    - /var/log/nginx/error.log
  tags: ["error"]

output.elasticsearch:
  hosts: ["192.168.1.104:9200"]
  #index: "nginx-%{[beat.version]}-%{+yyyy.MM}"
  indices:
    - index: "nginx-access-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        tags: "access"
    - index: "nginx-error-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        tags: "error"

setup.template.name: "nginx"
setup.template.patten: "nginx-*"
setup.template.enabled: false
setup.template.overwrite: true
[root@efk ~]# systemctl restart filebeat.service 

删除刚才在es页面的nginx索引和在kibana页面创建的索引

刷新es页面会出现nginx成功和失败日志索引

在kibana创建nginx成功 和失败日志索引