欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识!
您现在的位置是: 首页

Logstash、Kafka和ElastaticSearch安装以及简单使用(Linux)

程序员文章站 2022-06-14 10:35:24
...

前段时间公司需要做一个日志分析的需求,于是开始了对于日志分析这方面的研究。现在系统中集成的是Fluem + elastaticSearch + 还有influxdb,如果基于这些做日志分析的话,就可能需要使用Flume + kafka + elastaticSearch但是我对比了一下Flume和logstash 他们共同的特点是支持的采集方式很全,支持分布式。区别在于Flume作为生产方传输数据的功能比较强大,而logstash在做数据处理时支持grok表达式,在收集数据集进行格式化比较有优势,综合分析需求最后还是选择使用ELK这一套技术架构。

废话不多说了,开始干正事。

版本:  elasticsearch-5.2.2

logstash-5.2.2

kafka_2.10-0.10.2.1(logstash + kafka必须使用0.9以上版本)

注意:版本问题一定要搞清楚,千万别乱了,本人在版本上出过两个问题,第一次是JavaAPI消费不了kafka里面的数据。另一个是logstash的数据传不进kafka。

一、首选安装ElastaticSearch

1、首先在opt文件夹创建elasticsearch文件夹

mkdir elasticsearch
2、把elasticsearch-5.2.2.tar.gz拷贝到该目录下解压
tar -zxvf elasticsearch-5.2.2.tar.gz
3、修改/opt/elasticsearch/elasticsearch-5.2.2/config/elasticsearch.yml配置文件
(该配置文件不用修改其实也能直接运行,但是内外网可能无法访问,其他配置在文档上都有注释可以根据自己的需求配置)
network.host: 0.0.0.0
这样就可以内网访问了。

4、启动。ES启动为了安全是不支持root启动的,需要使用其他用户启动

[[email protected] elasticsearch-5.2.2]# su me
[[email protected] elasticsearch-5.2.2]$ cd /opt/elasticsearch/elasticsearch-5.2.2/bin/
[[email protected] bin]$ ls -l
total 360
-rwxrwxrwx. 1 root root   7852 May 26 05:28 elasticsearch
-rwxrwxrwx. 1 root root   3341 May 26 05:28 elasticsearch.bat
-rwxrwxrwx. 1 root root    828 May 26 05:28 elasticsearch.in.bat
-rwxrwxrwx. 1 root root    404 May 26 05:28 elasticsearch.in.sh
-rwxrwxrwx. 1 root root   2540 May 26 05:28 elasticsearch-plugin
-rwxrwxrwx. 1 root root    733 May 26 05:28 elasticsearch-plugin.bat
-rwxrwxrwx. 1 root root  11239 May 26 05:28 elasticsearch-service.bat
-rwxrwxrwx. 1 root root 104448 May 26 05:28 elasticsearch-service-mgr.exe
-rwxrwxrwx. 1 root root 103936 May 26 05:28 elasticsearch-service-x64.exe
-rwxrwxrwx. 1 root root  80896 May 26 05:28 elasticsearch-service-x86.exe
-rwxrwxrwx. 1 root root    223 May 26 05:28 elasticsearch-systemd-pre-exec
-rwxrwxrwx. 1 root root   2514 May 26 05:28 elasticsearch-translog
-rwxrwxrwx. 1 root root   1435 May 26 05:28 elasticsearch-translog.bat
-rwxrwxrwx. 1 root root  16442 May 26 05:28 hs_err_pid6021.log
[[email protected] bin]$ ./elasticsearch
OK,这样就可以启动成功。但是注意如果用虚拟机的话,可能出现分配的内存太少,ES的默认启动内存就是2G这个可以在:/opt/elasticsearch/elasticsearch-5.2.2/config/jvm.options修改参数
# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space

-Xms512m
-Xmx512m
二、安装Logstash并采集Tomcat access日志
1、在opt目录下创建文件夹
mkdir Logstash
2、拷贝logstash-5.2.2.tar.gz 到Logstash目录 然后解压
tar -zxvf logstash-5.2.2.tar.gz
3、在bin目录或者是config目录创建tomcat_access.config文件(这个目录是在启动的时候指定的我为了方便直接写在了bin目录下内容如下)
input {
    file {
        path => "/opt/tomcat/apache-tomcat-8.5.15/logs/localhost_access_log.*.txt"#监控       本地的Tomcat access日志
        start_position => "beginning"
    }
}

filter {
  grok {
      patterns_dir => "/opt/logstash/logstash-5.2.2/patterns" #指定正则文件的存放位置
      match => {
      "message" => "%{ACCESSLOG}" #调用access日志正则
      }
  }
}
output{
    stdout{ #标准输出控制台
        codec => rubydebug
    }
    elasticsearch {
      hosts => ["10.255.0.167"] #输出到ES
        index => "tomcat-acccess" #索引名
    }
}
4、 启动(直接进入logstash bin目录 -f 是指的当前文件夹下刚才创建的tomcat_access.config )

./logstash -f tomcat_access.config
启动成功后,随便点击几下Tomcat上运行的项目,ES马上就有一个tomcat-acccess索引.这样就OK啦!

三、安装kafka(Java API消费kafka以后会有单独一节介绍,这里只是介绍如何安装)
1.kafka的启动依赖于zookeeper所以首先要安装zookeeper。在opt目录下创建两个文件夹
mkdir zookeeper
mkdir kafka
2.在zookeeper文件夹里解压zookeeper
tar -zxvf zookeeper-3.4.9.tar.gz
3.在安装目录下找到conf文件夹的zoo_sample.cfg重命名为zoo.cfg(最好是copy以防万一)
4.zookeeper的服务直接在bin目录下执行
1. 启动ZK服务:       ./zkServer.sh start
2. 停止ZK服务:       ./zkServer.sh stop
3. 重启ZK服务:       ./zkServer.sh restart
4. 查看ZK服务状态:   ./zkServer.sh status

5.启动后执行jps(QuorumPeerMain进程就是zookeeper独立的进程s说明启动成功)

6.在/opt/kafka目录下解压kafka_2.11-0.10.2.1.tgz

tar -zxvf kafka_2.11-0.10.2.1.tgz
7.修改kafka安装目录config server.properties修改配置信息(下面贴一个完整可运行的测试配置)
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# see kafka.server.KafkaConfig for additional details and defaults

############################# Server Basics #############################

# The id of the broker. This must be set to a unique integer for each broker.
broker.id=0

# Switch to enable topic deletion or not, default value is false
#delete.topic.enable=true

############################# Socket Server Settings #############################

# The address the socket server listens on. It will get the value returned from 
# java.net.InetAddress.getCanonicalHostName() if not configured.
#   FORMAT:
#     listeners = listener_name://host_name:port
#   EXAMPLE:
#     listeners = PLAINTEXT://your.host.name:9092
#listeners=PLAINTEXT://:9092

# Hostname and port the broker will advertise to producers and consumers. If not set, 
# it uses the value for "listeners" if configured.  Otherwise, it will use the value
# returned from java.net.InetAddress.getCanonicalHostName().
advertised.listeners=PLAINTEXT://10.255.0.167:9092

# Maps listener names to security protocols, the default is for them to be the same. See the config documentation for more details
#listener.security.protocol.map=PLAINTEXT:PLAINTEXT,SSL:SSL,SASL_PLAINTEXT:SASL_PLAINTEXT,SASL_SSL:SASL_SSL

# The number of threads handling network requests
num.network.threads=3

# The number of threads doing disk I/O
num.io.threads=8

# The send buffer (SO_SNDBUF) used by the socket server
socket.send.buffer.bytes=102400

# The receive buffer (SO_RCVBUF) used by the socket server
socket.receive.buffer.bytes=102400

# The maximum size of a request that the socket server will accept (protection against OOM)
socket.request.max.bytes=104857600


############################# Log Basics #############################

# A comma seperated list of directories under which to store log files
log.dirs=/tmp/kafka-logs

# The default number of log partitions per topic. More partitions allow greater
# parallelism for consumption, but this will also result in more files across
# the brokers.
num.partitions=1

# The number of threads per data directory to be used for log recovery at startup and flushing at shutdown.
# This value is recommended to be increased for installations with data dirs located in RAID array.
num.recovery.threads.per.data.dir=1

############################# Log Flush Policy #############################

# Messages are immediately written to the filesystem but by default we only fsync() to sync
# the OS cache lazily. The following configurations control the flush of data to disk.
# There are a few important trade-offs here:
#    1. Durability: Unflushed data may be lost if you are not using replication.
#    2. Latency: Very large flush intervals may lead to latency spikes when the flush does occur as there will be a lot of data to flush.
#    3. Throughput: The flush is generally the most expensive operation, and a small flush interval may lead to exceessive seeks.
# The settings below allow one to configure the flush policy to flush data after a period of time or
# every N messages (or both). This can be done globally and overridden on a per-topic basis.

# The number of messages to accept before forcing a flush of data to disk
#log.flush.interval.messages=10000

# The maximum amount of time a message can sit in a log before we force a flush
#log.flush.interval.ms=1000

############################# Log Retention Policy #############################

# The following configurations control the disposal of log segments. The policy can
# be set to delete segments after a period of time, or after a given size has accumulated.
# A segment will be deleted whenever *either* of these criteria are met. Deletion always happens
# from the end of the log.

# The minimum age of a log file to be eligible for deletion due to age
log.retention.hours=168

# A size-based retention policy for logs. Segments are pruned from the log as long as the remaining
# segments don't drop below log.retention.bytes. Functions independently of log.retention.hours.
#log.retention.bytes=1073741824

# The maximum size of a log segment file. When this size is reached a new log segment will be created.
log.segment.bytes=1073741824

# The interval at which log segments are checked to see if they can be deleted according
# to the retention policies
log.retention.check.interval.ms=300000

############################# Zookeeper #############################

# Zookeeper connection string (see zookeeper docs for details).
# This is a comma separated host:port pairs, each corresponding to a zk
# server. e.g. "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002".
# You can also append an optional chroot string to the urls to specify the
# root directory for all kafka znodes.
zookeeper.connect=localhost:2181

# Timeout in ms for connecting to zookeeper
zookeeper.connection.timeout.ms=6000
8.启动kafka在bin目录下执行(后面就是指定的server.properties文件路径)
./kafka-server-start.sh ../config/server.properties
9.创建 topic 名为 test
./bin/kafka-topics.sh --create --zookeeper localhost:2181 --replication-factor 1 --partitions 1 --topic test
10.进去安装根目录,创建一个新的终端执行一个生产者
bin/kafka-console-producer.sh --broker-list 10.255.0.167:9092 --topic test #该成自己的对应的IP
11.进去安装根目录,再创建一个终端执行一个消费者
bin/kafka-console-consumer.sh --zookeeper 10.255.0.167:2181 --topic test #du对应自己的IP
这样kafka就安装成功了。
这里再附几个kafka常用的几个命令:
#通过group_id 查看当前详细的消费情况
bin/kafka-consumer-groups.sh --group logstashtest--describe --zookeeper 127.0.0.1:2181
#查看topic属性
bin/kafka-topics.sh --zookeeper localhost:2181 --describe --topic topicname
#查看kafka log文件详细信息
bin/kafka-run-class.sh kafka.tools.DumpLogSegments --files /tmp/kafka-logs/test3-0/00000000000000000000.log  --print-data-log   #--files 对应的data数据路径

附:这样子基本上环境就是搭建完成了,但是整个ELK的技术栈还有很多东西比如,Logstash的beat采集插件、kafka-manager管理工具、还有用来展示的Kibana、ES的head插件,有时间我就补充上。







相关标签: java kafka es