NET-ELK Monitoring scheme

NET ELK Monitoring Solution https://www.jianshu.com/p/3c26695cfc38

The background is not much to say, who does not have a few ten systems running AH. How to monitor the health of these dozens of systems, for non-operators, too much TM.
The background is not much to say, who does not have a few ten systems running AH. How to monitor the health of these dozens of systems, for non-operating personnel, too much TM ...

Noun
ELK = elashticsearch + LogStash + Kibana
Lucene is a search engine, the characteristics of the search engine is needless to say. But it's not too intuitive to use.
Elashticsearch (ES) is based on Luncene. It provides a set of easy-to-use syntax, the key point: it can be easily manipulated through HTTP.
Logstash is mainly used to analyze (process) The log (do not know this is inappropriate). By specifying the output of the Logstash, you can write the results of the processing to ES.
Kibana is used for the development of various reports.
That is, in Elk: E (storage), L (processing), K (show)

ELK requires a Java runtime environment, but does not mean that it is a specialized tool in the Java world.

The long-standing opposition of the gate faction
Do as. NET developers, the number of Java tools is a bit of a contradiction, can not be used, can use less, there is no way to check the information ... That's how I came along.

Log4net believe that everyone is using, so my first solution is to write a log4net appender extension, derived from Appenderskeleton a esappender, the code is very simple, not shown here.

But the speed of writing logs is a bit fast (the production of about 1.5G of text logs per day, or simplified ...) ), the status of ES is uncertain, may result in data loss, or ES processing is not timely, drag the program hind legs and so on. Collecting logs is trivial, dragging the program hind legs is a big deal ...

So, in the end, the old and honest use of ELK this complete set of solutions:
Extended Log4net write JSON-formatted logs, Logstash collect these logs ...

How to integrate ELK into. NET projects
As explained above, here is the log4net to write JSON-formatted text logs, because Logstash's configuration syntax is our "interface-based", "simple-minded" programmers do not understand (too troublesome, really distressed Java programmers, the face of so many Bible-like configuration every day); The JSON-formatted log, in Logstash, is written as-is into ES, eliminating the heap of configurations that cannot be understood by the filter.

Extend Log4net, derive a jsonlayout from Layoutskeleton

///

///
///
public class Jsonlayout:layoutskeleton
{

public override string contenttype{get {return "Application/json"; }}public Jsonlayout () {this. Ignoresexception = false;} public override void Activateoptions () {//}public override void Format (TextWriter writer, loggingevent evt) {if (!ev    T.level.displayname.equals ("ES")) return; var info = evt.    Locationinformation;    var extitle = "";    var exstack = ""; if (evt. Exceptionobject = null) {Extitle = evt.        Exceptionobject.message; Exstack = evt.    Exceptionobject.stacktrace; } var msg = new Jsonmsg () {esindexprefix = Esindex.esindexprefix, Logger = evt. Loggername,//@Class = info. After classname,//is released, the parameter//file = info is not obtained. After filename,//is released, the parameter//line = info is not obtained. After linenumber,//is released, the parameter//method = info is not obtained. After the methodname,//is released, the parameter CreatedOn = EVT is not obtained. TimeStamp, App = evt. Domain,//level = evt. Level.name, useless, dot hdd Data = evt. Messageobject, Extitle = Extitle, Exstack = Exstack};    var json = Jsonconvert.serializeobject (msg); Writer. WriteLine (JSON);}

}
Ignoresexception = False is the output that ignores Exception, otherwise a string of strings is appended to the JSON string to describe the exception information.

JsonMsg.cs

Internal class Jsonmsg
{

[JsonProperty("i")]public string ESIndexPrefix{    get;    set;}[JsonProperty("L")]public string Logger{    get;    set;} [JsonProperty("On")]public DateTime CreatedOn{    get;    set;}[JsonProperty("D")]public object Data{    get;    set;}[JsonProperty("Ex")]public string ExStack{    get;    set;}[JsonProperty("ExT")]public string ExTitle{    get;    set;}public string App{    get;    set;}

}
Add a Helper

public static Class Loghelper
{

private static readonly Type DeclareType = typeof(LogHelper);private static readonly Level Level = new Level(130000, "ES");public static void ES(this ILog logger, AnalyzeLogItem data, Exception ex = null){    logger.Logger.Log(DeclareType, Level, data, ex);}

}
This code customizes a level called "ES" and defines a simple extension function that uses custom parameters: Analyzelogitem, the Analyzelogitem is the data to be used for analysis, such as execution time, execution success or failure, Respond to requests or send requests, etc., depending on your needs.

Then modify the Log4net.config.

<appender-ref ref="InfoFileAppender" /><appender-ref ref="ErrorFileAppender" /><appender-ref ref="FatalFileAppender" /><appender-ref ref="DebugFileAppender" /><appender-ref ref="WARNFileAppender" /><appender-ref ref="ESAppender" />

Note the layout type= "XXX" in the first paragraph (esappender). Jsonlayout,xxx ", modify the package name for yourself.
Also, you cannot use UTF-8.
Because under WINDOWS, log4net production of UTF-8 log file by default is with the BOM, Logstash this Java World tool, too idealistic, seems to have not considered the BOM problem, so as to lead to data loss serious (how serious?) Millions of diary only a fraction of the analysis) ...
If the following words appear in the Logstash console, then sorta:

11:17:54.244 [[main]<file] Error Logstash.codecs.json-json parse error, original data now in message field {: ERROR=&G T;#<logstash::json::P arsererror:unexpected character ('??? ' (Code 65279/0xfeff)): expected a valid value (number, String, array, object, ' true ', ' false ' or ' null ')
Finally, add the following in your AssemblyInfo:

[Assembly:log4net. Config.xmlconfigurator (configfile = "Log4net.config", Watch = True)]
Configure Logstash
As stated above, we directly generate a JSON-formatted log record in order to avoid complex logstash configurations. So the configuration here is simple:

input{
File {
Path = [
"D:/web/api1/w1/loges/.",
"D:/web/api1/w2/loges/."
]
codec = "JSON"
}
}

Output {
Elasticsearch {
hosts = ["10.89.70.70:9600"]
index = "%{i}-%{+yyyy. MM.DD} "
}
}
The two lines in the path node are the log paths to parse, and the multiple bars are separated by commas.
Hosts is the address of ES (with an intranet address faster than an order of magnitude)
Index is the dynamic index name, where I (%{i}) is the resulting JSON log I (that is, esindexprefix in jsonmsg above). The advantage of this is that the log data for different systems can be categorized by index.
Kibana
Kibana configuration will not say, too simple, here only one final log analysis:

Gruan
Links: https://www.jianshu.com/p/3c26695cfc38
Source: Pinterest
Copyright belongs to the author. Commercial reprint please contact the author for authorization, non-commercial reprint please specify the source.

NET-ELK Monitoring scheme