码迷，mamicode.com
首页 > 其他好文 > 详细

kibana应用 logstash应用

时间：2019-04-28 19:03:42      阅读：137      评论：0      收藏：0      [点我收藏+]

标签：style   scp   数据结构   play   wow   9.png   logs   意思   读取文件   

Top

NSD ARCHITECTURE DAY04

  1. 案例1：导入数据
  2. 案例2：综合练习

1 案例1：导入数据

1.1 问题

本案例要求批量导入数据：

  • 批量导入数据并查看

1.2 步骤

实现此案例需要按照如下步骤进行。

步骤一：导入数据

使用POST方式批量导入数据，数据格式为json，url 编码使用data-binary导入含有index配置的json文件

  1. [root@room9pc01 ~]# scp /var/ftp/elk/*.gz 192.168.1.66:/root/
  2. [root@kibana ~]# gzip -d logs.jsonl.gz
  3. [root@kibana ~]# gzip -d accounts.json.gz
  4. [root@kibana ~]# gzip -d shakespeare.json.gz
  5. [root@kibana ~]# curl -X POST "http://192.168.1.61:9200/_bulk" \
  6. --data-binary @shakespeare.json
  7. [root@kibana ~]# curl -X POST "http://192.168.1.61:9200/xixi/haha/_bulk" \
  8. --data-binary @accounts.json
  9. //索引是xixi，类型是haha，必须导入索引和类型，没有索引，要加上
  10. [root@kibana ~]# curl -X POST "http://192.168.1.61:9200/_bulk" \
  11. --data-binary @logs.jsonl

2）使用GET查询结果

  1. [root@kibana ~]# curl -XGET ‘http://192.168.1.61:9200/_mget?pretty‘ -d ‘{
  2. "docs":[
  3. {
  4. "_index":"shakespeare",
  5. "_type:":"act",
  6. "_id":0
  7. },
  8. {
  9. "_index":"shakespeare",
  10. "_type:":"line",
  11. "_id":0
  12. },
  13. {
  14. "_index":"xixi",
  15. "_type:":"haha",
  16. "_id":25
  17. }
  18. ]
  19. }‘
  20. {        //查询的结果
  21. "docs" : [ {
  22. "_index" : "shakespeare",
  23. "_type" : "act",
  24. "_id" : "0",
  25. "_version" : 1,
  26. "found" : true,
  27. "_source" : {
  28. "line_id" : 1,
  29. "play_name" : "Henry IV",
  30. "speech_number" : "",
  31. "line_number" : "",
  32. "speaker" : "",
  33. "text_entry" : "ACT I"
  34. }
  35. }, {
  36. "_index" : "shakespeare",
  37. "_type" : "act",
  38. "_id" : "0",
  39. "_version" : 1,
  40. "found" : true,
  41. "_source" : {
  42. "line_id" : 1,
  43. "play_name" : "Henry IV",
  44. "speech_number" : "",
  45. "line_number" : "",
  46. "speaker" : "",
  47. "text_entry" : "ACT I"
  48. }
  49. }, {
  50. "_index" : "xixi",
  51. "_type" : "haha",
  52. "_id" : "25",
  53. "_version" : 1,
  54. "found" : true,
  55. "_source" : {
  56. "account_number" : 25,
  57. "balance" : 40540,
  58. "firstname" : "Virginia",
  59. "lastname" : "Ayala",
  60. "age" : 39,
  61. "gender" : "F",
  62. "address" : "171 Putnam Avenue",
  63. "employer" : "Filodyne",
  64. "email" : "virginiaayala@filodyne.com",
  65. "city" : "Nicholson",
  66. "state" : "PA"
  67. }
  68. } ]
  69. }

步骤二：使用kibana查看数据是否导入成功

1）数据导入以后查看logs是否导入成功，如图-1所示：

  1. [root@se5 ~]# firefox http://192.168.1.65:9200/_plugin/head/
技术图片

图-1

2）kibana导入数据，如图-2所示：

  1. [root@kibana ~]# firefox http://192.168.1.66:5601
技术图片

图-2

3）成功创建会有logstash-*，如图-3所示：

/

图-3

4）导入成功之后选择Discover，如图-4所示：

技术图片

图-4

注意： 这里没有数据的原因是导入日志的时间段不对，默认配置是最近15分钟，在这可以修改一下时间来显示

5）kibana修改时间，选择Lsat 15 miuntes，如图-5所示：

技术图片

图-5

6）选择Absolute，如图-6所示：

技术图片

图-6

7）选择时间2015-5-15到2015-5-22，如图-7所示：

技术图片

图-7

8）查看结果，如图-8所示：

技术图片

图-8

9）除了柱状图，Kibana还支持很多种展示方式 ，如图-9所示：

技术图片

图-9

10）做一个饼图，选择Pie chart，如图-10所示：

技术图片

图-10

11）选择from a new serach，如图-11所示：

技术图片

图-11

12）选择Spilt Slices，如图-12所示：

技术图片

图-12

13）选择Trems,Memary(也可以选择其他的，这个不固定)，如图-13所示：

技术图片

图-13

14）结果，如图-14所示：

技术图片

图-14

15）保存后可以在Dashboard查看，如图-15所示：

技术图片

图-15

2 案例2：综合练习

2.1 问题

本案例要求：

  • 练习插件
  • 安装一台Apache服务并配置
  • 使用filebeat收集Apache服务器的日志
  • 使用grok处理filebeat发送过来的日志
  • 存入elasticsearch

2.2 步骤

实现此案例需要按照如下步骤进行。

步骤一：安装logstash

1）配置主机名，ip和yum源，配置/etc/hosts（请把se1-se5和kibana主机配置和logstash一样的/etc/hosts）

  1. [root@logstash ~]# vim /etc/hosts
  2. 192.168.1.61 se1
  3. 192.168.1.62 se2
  4. 192.168.1.63 se3
  5. 192.168.1.64 se4
  6. 192.168.1.65 se5
  7. 192.168.1.66 kibana
  8. 192.168.1.67 logstash

2）安装java-1.8.0-openjdk和logstash

  1. [root@logstash ~]# yum -y install java-1.8.0-openjdk
  2. [root@logstash ~]# yum -y install logstash
  3. [root@logstash ~]# java -version
  4. openjdk version "1.8.0_131"
  5. OpenJDK Runtime Environment (build 1.8.0_131-b12)
  6. OpenJDK 64-Bit Server VM (build 25.131-b12, mixed mode)
  7. [root@logstash ~]# touch /etc/logstash/logstash.conf
  8. [root@logstash ~]# /opt/logstash/bin/logstash --version
  9. logstash 2.3.4
  10. [root@logstash ~]# /opt/logstash/bin/logstash-plugin list //查看插件
  11. ...
  12. logstash-input-stdin    //标准输入插件
  13. logstash-output-stdout    //标准输出插件
  14. ...
  15. [root@logstash ~]# vim /etc/logstash/logstash.conf
  16. input{
  17. stdin{
  19. }
  20. }
  22. filter{
  24. }
  26. output{
  27. stdout{
  29. }
  30. }
  32. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  33. //启动并测试
  34. Settings: Default pipeline workers: 2
  35. Pipeline main started
  36. aa        //logstash 配置从标准输入读取输入源,然后从标准输出输出到屏幕
  37. 2018-09-15T06:19:28.724Z logstash aa

备注：若不会写配置文件可以找帮助，插件文档的位置：

https://github.com/logstash-plugins

3）codec类插件

  1. [root@logstash ~]# vim /etc/logstash/logstash.conf
  2. input{
  3. stdin{
  4. codec => "json"        //输入设置为编码json
  5. }
  6. }
  8. filter{
  10. }
  12. output{
  13. stdout{
  14. codec => "rubydebug"        //输出设置为rubydebug
  15. }
  16. }
  17. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  18. Settings: Default pipeline workers: 2
  19. Pipeline main started
  20. {"a":1}
  21. {
  22. "a" => 1,
  23. "@version" => "1",
  24. "@timestamp" => "2018-09-15T06:34:14.538Z",
  25. "host" => "logstash"
  26. }

4）file模块插件

  1. [root@logstash ~]# vim /etc/logstash/logstash.conf
  2. input{
  3. file {
  4. path => [ "/tmp/a.log", "/var/tmp/b.log" ]
  5. sincedb_path => "/var/lib/logstash/sincedb"    //记录读取文件的位置
  6. start_position => "beginning"                //配置第一次读取文件从什么地方开始
  7. type => "testlog"                    //类型名称
  8. }
  9. }
  11. filter{
  13. }
  15. output{
  16. stdout{
  17. codec => "rubydebug"
  18. }
  19. }
  21. [root@logstash ~]# touch /tmp/a.log
  22. [root@logstash ~]# touch /var/tmp/b.log
  23. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf

另开一个终端：写入数据

  1. [root@logstash ~]# echo a1 > /tmp/a.log
  2. [root@logstash ~]# echo b1 > /var/tmp/b.log

之前终端查看：

  1. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  2. Settings: Default pipeline workers: 2
  3. Pipeline main started
  4. {
  5. "message" => "a1",
  6. "@version" => "1",
  7. "@timestamp" => "2018-09-15T06:44:30.671Z",
  8. "path" => "/tmp/a.log",
  9. "host" => "logstash",
  10. "type" => "testlog"
  11. }
  12. {
  13. "message" => "b1",
  14. "@version" => "1",
  15. "@timestamp" => "2018-09-15T06:45:04.725Z",
  16. "path" => "/var/tmp/b.log",
  17. "host" => "logstash",
  18. "type" => "testlog"
  19. }
  20.     

5）tcp、udp模块插件

  1. [root@logstash ~]# vim /etc/logstash/logstash.conf
  2. input{
  3. file {
  4. path => [ "/tmp/a.log", "/var/tmp/b.log" ]
  5. sincedb_path => "/var/lib/logstash/sincedb"
  6. start_position => "beginning"
  7. type => "testlog"
  8. }
  9. tcp {
  10. host => "0.0.0.0"
  11. port => "8888"
  12. type => "tcplog"
  13. }
  14. udp {
  15. host => "0.0.0.0"
  16. port => "9999"
  17. type => "udplog"
  18. }
  19. }
  21. filter{
  23. }
  24. output{
  25. stdout{
  26. codec => "rubydebug"
  27. }
  28. }
  29. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  30. //启动

另开一个终端查看，可以看到端口

  1. [root@logstash tmp]# netstat -antup | grep 8888
  2. tcp6 0 0 :::8888 :::* LISTEN 22191/java
  3. [root@logstash tmp]# netstat -antup | grep 9999
  4. udp6 0 0 :::9999 :::* 22191/java

在另一台主机上写一个脚本，发送数据，使启动的logstash可以接收到数据

  1. [root@se5 ~]# vim tcp.sh
  2. function sendmsg(){
  3. if [[ "$1" == "tcp" ]];then
  4. exec 9<>/dev/tcp/192.168.1.67/8888
  5. else
  6. exec 9<>/dev/udp/192.168.1.67/9999
  7. fi
  8. echo "$2" >&9
  9. exec 9<&-
  10. }
  11. [root@se5 ~]# . tcp.sh        //重新载入一下
  12. [root@se5 ~]# sendmsg udp "is tcp test"
  13. [root@se5 ~]# sendmsg udp "is tcp ss"

logstash主机查看结果

  1. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  2. Settings: Default pipeline workers: 2
  3. Pipeline main started
  4. {
  5. "message" => "is tcp test\n",
  6. "@version" => "1",
  7. "@timestamp" => "2018-09-15T07:45:00.638Z",
  8. "type" => "udplog",
  9. "host" => "192.168.1.65"
  10. }
  11. {
  12. "message" => "is tcp ss\n",
  13. "@version" => "1",
  14. "@timestamp" => "2018-09-15T07:45:08.897Z",
  15. "type" => "udplog",
  16. "host" => "192.168.1.65"
  17. }

6）syslog插件练习

  1. [root@logstash ~]# systemctl list-unit-files | grep syslog
  2. rsyslog.service enabled
  3. syslog.socket static
  4. [root@logstash ~]# vim /etc/logstash/logstash.conf
  5. start_position => "beginning"
  6. type => "testlog"
  7. }
  8. tcp {
  9. host => "0.0.0.0"
  10. port => "8888"
  11. type => "tcplog"
  12. }
  13. udp {
  14. host => "0.0.0.0"
  15. port => "9999"
  16. type => "udplog"
  17. }
  18. syslog {
  19. port => "514"
  20. type => "syslog"
  21. }
  22. }
  24. filter{
  26. }
  28. output{
  29. stdout{
  30. codec => "rubydebug"
  31. }
  32. }

另一个终端查看是否检测到514

  1. [root@logstash ~]# netstat -antup | grep 514
  2. tcp6 0 0 :::514 :::* LISTEN 22728/java
  3. udp6 0 0 :::514 :::* 22728/java

另一台主机上面操作,本地写的日志本地可以查看

  1. [root@se5 ~]# vim /etc/rsyslog.conf
  2. local0.info /var/log/mylog //自己添加这一行
  3. [root@se5 ~]# systemctl restart rsyslog    //重启rsyslog
  4. [root@se5 ~]# ll /var/log/mylog        //提示没有那个文件或目录
  5. ls: cannot access /var/log/mylog: No such file or directory
  6. [root@se5 ~]# logger -p local0.info -t nsd "elk"        //写日志
  7. [root@se5 ~]# ll /var/log/mylog        //再次查看，有文件
  8. -rw------- 1 root root 29 Sep 15 16:23 /var/log/mylog
  9. [root@se5 ~]# tail /var/log/mylog //可以查看到写的日志
  10. Sep 15 16:23:25 se5 nsd: elk
  11. [root@se5 ~]# tail /var/log/messages
  12. //可以查看到写的日志，因为配置文件里有写以.info结尾的可以收到
  13. ...
  14. Sep 15 16:23:25 se5 nsd: elk

把本地的日志发送给远程1.67

  1. [root@se5 ~]# vim /etc/rsyslog.conf
  2. local0.info @192.168.1.67:514
  3. //写一个@或两个@@都可以，一个@代表udp，两个@@代表tcp
  4. [root@se5 ~]# systemctl restart rsyslog
  5. [root@se5 ~]# logger -p local0.info -t nds "001 elk"
  6. [root@logstash bin]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  7. //检测到写的日志
  8. {
  9. "message" => "001 elk",
  10. "@version" => "1",
  11. "@timestamp" => "2018-09-05T09:15:47.000Z",
  12. "type" => "syslog",
  13. "host" => "192.168.1.65",
  14. "priority" => 134,
  15. "timestamp" => "Jun 5 17:15:47",
  16. "logsource" => "kibana",
  17. "program" => "nds1801",
  18. "severity" => 6,
  19. "facility" => 16,
  20. "facility_label" => "local0",
  21. "severity_label" => "Informational"
  22. }

rsyslog.conf配置向远程发送数据，远程登陆1.65的时侯，把登陆日志的信息（/var/log/secure）转发给logstash即1.67这台机器

  1. [root@se5 ~]# vim /etc/rsyslog.conf
  2. 57 authpriv.* @@192.168.1.67:514
  3. //57行的/var/log/secure改为@@192.168.1.67:514
  4. [root@se5 ~]# systemctl restart rsyslog
  5. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  6. //找一台主机登录1.65，logstash主机会有数据
  7. Settings: Default pipeline workers: 2
  8. Pipeline main started
  9. {
  10. "message" => "Accepted password for root from 192.168.1.254 port 33780 ssh2\n",
  11. "@version" => "1",
  12. "@timestamp" => "2018-09-15T08:40:57.000Z",
  13. "type" => "syslog",
  14. "host" => "192.168.1.65",
  15. "priority" => 86,
  16. "timestamp" => "Sep 15 16:40:57",
  17. "logsource" => "se5",
  18. "program" => "sshd",
  19. "pid" => "26133",
  20. "severity" => 6,
  21. "facility" => 10,
  22. "facility_label" => "security/authorization",
  23. "severity_label" => "Informational"
  24. }
  25. {
  26. "message" => "pam_unix(sshd:session): session opened for user root by (uid=0)\n",
  27. "@version" => "1",
  28. "@timestamp" => "2018-09-15T08:40:57.000Z",
  29. "type" => "syslog",
  30. "host" => "192.168.1.65",
  31. "priority" => 86,
  32. "timestamp" => "Sep 15 16:40:57",
  33. "logsource" => "se5",
  34. "program" => "sshd",
  35. "pid" => "26133",
  36. "severity" => 6,
  37. "facility" => 10,
  38. "facility_label" => "security/authorization",
  39. "severity_label" => "Informational"

7）filter grok插件

grok插件：

解析各种非结构化的日志数据插件

grok使用正则表达式把飞结构化的数据结构化

在分组匹配，正则表达式需要根据具体数据结构编写

虽然编写困难，但适用性极广

  1. [root@logstash ~]# vim /etc/logstash/logstash.conf
  2. input{
  3. stdin{ codec => "json" }
  4. file {
  5. path => [ "/tmp/a.log", "/var/tmp/b.log" ]
  6. sincedb_path => "/var/lib/logstash/sincedb"
  7. start_position => "beginning"
  8. type => "testlog"
  9. }
  10. tcp {
  11. host => "0.0.0.0"
  12. port => "8888"
  13. type => "tcplog"
  14. }
  15. udp {
  16. host => "0.0.0.0"
  17. port => "9999"
  18. type => "udplog"
  19. }
  20. syslog {
  21. port => "514"
  22. type => "syslog"
  23. }
  24. }
  26. filter{
  27. grok{
  28. match => ["message", "(?<key>reg)"]
  29. }
  30. }
  32. output{
  33. stdout{
  34. codec => "rubydebug"
  35. }
  36. }
  37. [root@se5 ~]# yum -y install httpd
  38. [root@se5 ~]# systemctl restart httpd
  39. [root@se5 ~]# vim /var/log/httpd/access_log
  40. 192.168.1.254 - - [15/Sep/2018:18:25:46 +0800] "GET / HTTP/1.1" 403 4897 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"

复制/var/log/httpd/access_log的日志到logstash下的/tmp/a.log

  1. [root@logstash ~]# vim /tmp/a.log
  2. 192.168.1.254 - - [15/Sep/2018:18:25:46 +0800] "GET / HTTP/1.1" 403 4897 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
  4. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  5. //出现message的日志，但是没有解析是什么意思
  6. Settings: Default pipeline workers: 2
  7. Pipeline main started
  8. {
  9. "message" => ".168.1.254 - - [15/Sep/2018:18:25:46 +0800] \"GET / HTTP/1.1\" 403 4897 \"-\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0\"",
  10. "@version" => "1",
  11. "@timestamp" => "2018-09-15T10:26:51.335Z",
  12. "path" => "/tmp/a.log",
  13. "host" => "logstash",
  14. "type" => "testlog",
  15. "tags" => [
  16. [0] "_grokparsefailure"
  17. ]
  18. }

若要解决没有解析的问题，同样的方法把日志复制到/tmp/a.log，logstash.conf配置文件里面修改grok

查找正则宏路径

  1. [root@logstash ~]# cd /opt/logstash/vendor/bundle/ \
  2. jruby/1.9/gems/logstash-patterns-core-2.0.5/patterns/
  3. [root@logstash ~]# vim grok-patterns //查找COMBINEDAPACHELOG
  4. COMBINEDAPACHELOG %{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}
  6. [root@logstash ~]# vim /etc/logstash/logstash.conf
  7. ...
  8. filter{
  9. grok{
  10. match => ["message", "%{COMBINEDAPACHELOG}"]
  11. }
  12. }
  13. ...

解析出的结果

  1. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  2. Settings: Default pipeline workers: 2
  3. Pipeline main started
  4. {
  5. "message" => "192.168.1.254 - - [15/Sep/2018:18:25:46 +0800] \"GET /noindex/css/open-sans.css HTTP/1.1\" 200 5081 \"http://192.168.1.65/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0\"",
  6. "@version" => "1",
  7. "@timestamp" => "2018-09-15T10:55:57.743Z",
  8. "path" => "/tmp/a.log",
  9. "host" => "logstash",
  10. "type" => "testlog",
  11. "clientip" => "192.168.1.254",
  12. "ident" => "-",
  13. "auth" => "-",
  14. "timestamp" => "15/Sep/2018:18:25:46 +0800",
  15. "verb" => "GET",
  16. "request" => "/noindex/css/open-sans.css",
  17. "httpversion" => "1.1",
  18. "response" => "200",
  19. "bytes" => "5081",
  20. "referrer" => "\"http://192.168.1.65/\"",
  21. "agent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0\""
  22. }

步骤二：?安装Apache服务，用filebeat收集Apache服务器的日志，存入elasticsearch

1）在之前安装了Apache的主机上面安装filebeat

  1. [root@se5 ~]# yum -y install filebeat
  2. [root@se5 ~]# vim/etc/filebeat/filebeat.yml
  3. paths:
  4.     - /var/log/httpd/access_log //日志的路径，短横线加空格代表yml格式
  5. document_type: apachelog //文档类型
  6. elasticsearch:        //加上注释
  7. hosts: ["localhost:9200"]                //加上注释
  8. logstash:                    //去掉注释
  9. hosts: ["192.168.1.67:5044"]     //去掉注释,logstash那台主机的ip
  10. [root@se5 ~]# systemctl start filebeat
  12. [root@logstash ~]# vim /etc/logstash/logstash.conf
  13. input{
  14. stdin{ codec => "json" }
  15. beats{
  16. port => 5044
  17. }
  18. file {
  19. path => [ "/tmp/a.log", "/var/tmp/b.log" ]
  20. sincedb_path => "/dev/null"
  21. start_position => "beginning"
  22. type => "testlog"
  23. }
  24. tcp {
  25. host => "0.0.0.0"
  26. port => "8888"
  27. type => "tcplog"
  28. }
  29. udp {
  30. host => "0.0.0.0"
  31. port => "9999"
  32. type => "udplog"
  33. }
  34. syslog {
  35. port => "514"
  36. type => "syslog"
  37. }
  38. }
  40. filter{
  41. if [type] == "apachelog"{
  42. grok{
  43. match => ["message", "%{COMBINEDAPACHELOG}"]
  44. }}
  45. }
  47. output{
  48. stdout{ codec => "rubydebug" }
  49. if [type] == "filelog"{
  50. elasticsearch {
  51. hosts => ["192.168.1.61:9200", "192.168.1.62:9200"]
  52. index => "filelog"
  53. flush_size => 2000
  54. idle_flush_time => 10
  55. }}
  56. }
  57. [root@logstash logstash]# /opt/logstash/bin/logstash \
  58. -f /etc/logstash/logstash.conf

打开另一终端查看5044是否成功启动

  1. [root@logstash ~]# netstat -antup | grep 5044
  2. tcp6 0 0 :::5044 :::* LISTEN 23776/java
  4. [root@se5 ~]# firefox 192.168.1.65 //ip为安装filebeat的那台机器

回到原来的终端，有数据

2）修改logstash.conf文件

  1. [root@logstash logstash]# vim logstash.conf
  2. ...
  3. output{
  4. stdout{ codec => "rubydebug" }
  5. if [type] == "apachelog"{
  6. elasticsearch {
  7. hosts => ["192.168.1.61:9200", "192.168.1.62:9200"]
  8. index => "apachelog"
  9. flush_size => 2000
  10. idle_flush_time => 10
  11. }}
  12. }

浏览器访问Elasticsearch，有apachelog，如图-16所示：

技术图片

图-16

kibana应用 logstash应用

标签：style   scp   数据结构   play   wow   9.png   logs   意思   读取文件   

原文地址：https://www.cnblogs.com/tiki/p/10785554.html
踩
(0)
赞
(0)
   
举报
评论 一句话评论（0）
登录后才能评论！
分享档案
更多>
2021年07月29日 (22)
2021年07月28日 (40)
2021年07月27日 (32)
2021年07月26日 (79)
2021年07月23日 (29)
2021年07月22日 (30)
2021年07月21日 (42)
2021年07月20日 (16)
2021年07月19日 (90)
2021年07月16日 (35)
周排行
mamicode.com排行更多图片
更多
友情链接
兰亭集智   国之画   百度统计   站长统计   阿里云   chrome插件   新版天听网
关于我们 - 联系我们 - 留言反馈
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码！