ELK是三個開源軟件的縮寫，分別表示：Elasticsearch , Logstash, Kibana , 它們都是開源軟件。

Elasticsearch：可以理解成一個倉庫

Logstash：過濾器，分析器，重量級的日誌收集工具

Kibana：圖形化的展示，日誌的進一步分析

由於Logstash是個重量級的日誌收集工具，會消耗大量的資源，所以我們在日常的生產環境通常會使用到filebeat這個輕量級的日誌收集工具。

二、簡析日誌走向

三、生產環境的使用

1.filebeat (版本必須低於elk的版本，不然日誌收集會報錯）

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.2.0-x86_64.rpm

vim /etc/filebeat/filebeat.yml

...

paths:

- /application/nginx/logs/*.log

...

output.logstash:

# The Logstash hosts

hosts: ["l0.0.0.10:5044"]

...
2.Elasticsearch

rpm -ivh  elasticsearch-6.0.0.rpm

3. Logstash
wget https://artifacts.elastic.co/downloads/logstash/logstash-6.0.0.rpm

rpm -ivh  logstash-6.0.0.rpm

vim  log_nginx.conf

input {
	beats {
		port => 5044
	}
}

filter {
	if [logtype] == "Service" {
		grok {
			match => { "message" => "%{TIMESTAMP_ISO8601:log_time}\|%{GREEDYDATA:level}\|%{GREEDYDATA:component}\|%{GREEDYDATA:log_message}" }
		}
		
		if [component] !~ "^Sangmado.Inka.MomBrokers" {
			drop { }
		}
	}
	else {
		grok {
			match => { "message" => "\[%{TIMESTAMP_ISO8601:time_iso8601}\] \[%{NUMBER:pid}\] \[%{IPORHOST:remote_addr}\] \[%{IPORHOST:http_host}(:%{NUMBER:http_host_port})?\] \[%{IPORHOST:upstream_addr}(:%{NUMBER:upstream_port})?\] \[%{WORD:verb} %{URIPATH:request_uri}(?:%{URIPARAM:request_parameter})? HTTP/%{NUMBER:httpversion}\] \[%{NUMBER:status}\] \[%{BASE10NUM:upstream_response_time} s\] \[%{BASE10NUM:request_time} s\] \[(?:%{NUMBER:bytes_sent}|-) bytes\] \[(?:%{NUMBER:body_bytes_sent}|-) bytes\] \[%{GREEDYDATA:http_user_agent}\]" }
		}
		
		
		date {
			locale => "en"
			match => ["time_iso8601", "ISO8601"]
		 }

		mutate {
			convert => {
						"pid" => "integer"
						"upstream_response_time" => "float"
						"request_time" => "float"
						"status" => "integer"
						"bytes_sent" => "integer"
						"body_bytes_sent" => "integer"
					   }
		}
	}
}

output {
	
	elasticsearch {
						hosts => "localhost:9200"
						manage_template => false
						index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" 
						document_type => "%{[@metadata][type]}" 
			}
		
		
		stdout { 
			codec => rubydebug 
		}
}
3.kibana

 wget https://artifacts.elastic.co/downloads/kibana/kibana-6.0.0-x86_64.rpm

 rpm -ivh kibana-6.0.0-x86_64.rpm
 
4.啟動

systemctl restart elasticsearch.service

logstash/bin/logstash  -f   log_nginx.conf

systemctl start kibana

/etc/init.d/filebeat start


5.驗證

ELK在生產環境的簡單應用