Document directory
4. Performance Tuning
The purpose of this platform is to facilitate log query During O M and R D. Kibana is a free web shell. logstash integrates various log collection plug-ins and is also an excellent regular-cut log tool. elasticsearch is an open-source search engine framework (supporting cluster architecture ).
1 installation requirement 1.1 theoretical Topology
1.2 installation environment 1.2.1 hardware environment
192
The purpose of building this platform is to facilitate the operation of the research and development of the log query. Kibana a free web shell; Logstash integrates various collection log plug-ins, or is a good regular cutting log tool; Elasticsearch an open-source search engine framework that supports the cluster architecture approach.1 Installation Requirements 1.1 theoretical topology1.2 Installation Environment 1.2.1 hardware environment192.168.50.
Do Android 3 years, the network is not very concerned about, and now look let me eat a surprise, many of the previously expected features are open source, and powerful, try a bit. Simple trialDownload elasticsearch-1.4.2 and startDownload logstash-1.4.2, run the following commandBin/logstash-e ' input {stdin {}} output {elasticsearch {host = localhost}} 'The data entered by the console will be logstash to Elasticsearch (so Logstash is a data glue or connector)Found a more index (but also a usele
Recently in the log analysis of this piece, to use Logstash+elasticsearch+kibana to implement log import, filtering and visual management, official documentation is not detailed enough, the online articles are mostly either for the use of Linux systems, or the copying of other people's configuration is mostly impossible to run. It took a lot of effort to get rid of these three things, write a usage experience, nonsense not much to say, into the subjec
First heard elk, is Sina's @argv introduction internal use elk situation and scene, at that time touched very big, originally have so convenient way to collect log and show, have such tool, you do bad thing, delete log, it has no effect.A lot of companies say they are concerned about security, but they have not seen and watched the logs of their servers, which is a bit ironic. Manage the logs first, and then we'll discuss security in depth.Mirantis's fuel, has introduced elk as a monitoring tool
1. Workflow of Log Platform650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/71/5F/wKioL1XNWHGwPB_ZAAErAE7qZjQ757.jpg "title=" 1.png " alt= "Wkiol1xnwhgwpb_zaaerae7qzjq757.jpg"/>
shipper means log collection, using Logstash to collect log data from various sources, such as system logs, files, Redis, MQ, and so on;
broker as a buffer between the remote agent and the central agent, using Redis implementation, one can improve the performance of the system, the secon
Fluentd is an open source collection event and log system that currently offers 150 + extensions that let you store big data for log searches, data analysis and storage.
Official address http://fluentd.org/plugin address http://fluentd.org/plugin/
Kibana is a Web UI tool that provides log analysis for ElasticSearch, and it can be used to efficiently search, visualize, analyze, and perform various operations on logs. Official Address http://www.elastic
=" Head.png "alt=" Wkiom1esmxwaogtzaajhix4lznm047.png "/>Marvel Plugin : The first step on es: bin/plugin install license, bin/plugin install elasticsearch/marvel/latest (all es are installed) /c4>The second section is in the bin directory of the Kibana: Kibana plugin--install elasticsearch/marvel/latest650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M01/85/AE/wKioL1esMyizuCSsAAK1nD-zT9g214.png "titl
First, the visualize function of KibanaThe Visualize tab on the home page is used to design visual graphics. You can save the previous search in discovery to make a drawing, then save the visualize, or load the merge into dashboard. A visualization can be based on the following types of data sources:A new interactive searchA saved searchA saved visualizationHere are some of the types of visualize that Kibana comes withType useArea chart uses block dia
Filebeat is a lightweight, open source shipper for log file data. As the next-generation Logstash forwarder, filebeat tails logs and quickly sends this information to Logstash fo R further parsing and enrichment or to Elasticsearch for centralized storage and analysis.
Filebeat than Logstash seems better, is the next generation of log collectors, ELK (Elastic +logstash + Kibana) later estimated to be renamed EFK.
Filebeat How to use:
1, download the
Kibana + Logstash + Elasticsearch log query system, kibanalostash
The purpose of this platform is to facilitate log query During O M and R D. Kibana is a free web shell. Logstash integrates various log collection plug-ins and is also an excellent regular-cut log tool. Elasticsearch is an open-source search engine framework (supporting cluster architecture ).
1 installation requirement 1.1 theoretical Topo
After installation Kibana directly can access, this is not conducive to security, next we use Apache Password Authentication for security configurationThe Apache configuration file is as follows:authuserfile/data/kibana/.htpasswdThis is the file we want to store the password in.Next generate the password#htpasswd-C/data/kibana/.htpasswd user#new password: #Re-typ
In the Kibana display page, we click on the left column of table and find that the data in Elasticsearch is the correct data in the display, such as: Agent Www.baidu.com/test, the interface will be displayed correctly as Www.baidu.com /test, but if we show this field in term, will be divided into www.baidu.com and test two groups, by looking at Curl did not find any problems, and finally found the reason for elasticsearch to separate the results of
Kibana do not select the field you want to select, that is, the term to filter the selected field when the Discovery list does not have this option.650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/79/08/wKiom1aFAWuSYiPXAAAaSCMrdEo742.gif "style=" float: none; "title=" 3.gif "alt=" Wkiom1afawusyipxaaaascmrdeo742.gif "/>Go to discover to see, found that this field is preceded by a question mark, click to prompt this field is not indexed, not f
For details about how to import logs to elasticsearch clusters Through flume, see flume log import to elasticsearch clusters.Kibana Introduction
Kibana Homepage
Kibana is a powerful elasticsearch data display client. logstash has built-in kibana. You can also deploy kibana separately. The latest version of kibana3 is
you to collect, analyze, and store your logs for later use (e.g., search).
Kibana is also an open source and free tool, and he kibana a friendly Web interface for Logstash and Elasticsearch, which can help you summarize, analyze, and search important data logs.
Elk work flow is as follows:
Deploy Logstash on all services that need to collect logs, as Logstash agent (Logstash shipper) to monitor and filter
Elasticsearch+logstash+kibana ConfigurationThere are a lot of articles about the installation of Elasticsearch+logstash+kibana, which is not repeated here, only some of the more detailed content.
Considerations for installing in AWS EC2
9200,9300,5601 Port to remember to open
Elasticsearch address do not write external IP, otherwise it will be a waste of data, write internal IP"ip-10-1
In the use of the Kibana plug-in Discover feature, there are two shortcuts for "filter in" (finding data that matches this value) and "filter out" (excluding data that matches this value), and when working with date data, you are prompted with the following error:
Discover:failed to parse Date field [975542400000] with format [Year_month_day]
failed to parse date field [975542400 with format [Year_month_day]
As a hint, it should be an error that th
Nlog, Elasticsearch, Kibana and LogstashObjectiveRecently in the document management, it is necessary to record each administrator and user in the process of all operational records, originally through the EF directly to record the operation data in the database, when the query directly from the database read, but this is too stupid, so found on the Internet Logstash this NB tool, Share with you the process of learning.Environment preparationThese thr
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.