elasticsearch_river 配置

1. install es-river plugin

/usr/share/elasticsearch/bin/plugin -install elasticsearch/elasticsearch-river-rabbitmq/2.0.0

2. install rabbitmq
2.1 add epel repo
rpm –import https://fedoraproject.org/static/0608B895.txt
wget http://mirrors.yun-idc.com/epel/6/i386/epel-release-6-8.noarch.rpm

rpm -i epel-release-6-8.noarch.rpm

2.2 install erlang
yum -y install erlang

2.3 install rabbitmq
wget http://www.rabbitmq.com/releases/rabbitmq-server/v3.3.4/rabbitmq-server-3.3.4-1.noarch.rpm
rpm –import http://www.rabbitmq.com/rabbitmq-signing-key-public.asc
yum -y install rabbitmq-server-3.3.4-1.noarch.rpm

2.4 start rabbitmq

/etc/init.d/rabbitmq-server start

3 logstash conf


output{
elasticsearch_river {
es_host => “localhost”
index => “rt-%{+dd.HH.mm.ss}”
rabbitmq_host => “localhost”
workers => 8
}
}

4. restart elasticsearch

5. restart logstash

Share

使用 elasticsearch+logstash 存储获取实时日志【cdn realtime analytics】

安装的我就不写了。

主要说下方案

nginx 实时吐日志给syslog-ng via pipe
syslog-ng 向logstash 推送日志 via internet udp
logstash 把日志塞进elasticsearch 并index

发送方:
nginx.conf

# ...
log_format real_time '- $time_iso8601 $host $request_time $status $bytes_sent';
server {
        listen 80;
        server_name my_test_rt;
        access_log /dev/realtime.pipe real_time;
        location /{
                proxy_pass http://backend.com;
        }
    }
# ...

syslog-ng.conf

source s_pipe {
	pipe("/dev/realtime.pipe"); };

destination d_udp { udp("127.0.0.1" port(9999) template ("$MSG\n") ); };

log {source(s_pipe); destination(d_udp); };
#创建一个管道:
makefifo /dev/realtime.pipe

#先启动syslog-ng
#不然nginx启动时会卡住
service syslog-ng start

service nginx start

接收方:
/etc/logstash/conf.d/rt.conf

input {
	udp {
		port =>9999
	}
}

filter {
  grok {
    pattern => ["%{TIMESTAMP_ISO8601:timestamp} %{IPORHOST:host} %{IPORHOST:domain} %{NUMBER:request_time} %{NUMBER:status} %{NUMBER:bytes_sent}" ]
  }
  mutate {
    remove_field => [ "message", "@version" ]
  }
}
output {
	elasticsearch {
		host => "127.0.0.1"
		flush_size => 1
		index => "rt-%{+YYYY.MM.dd.HH.mm}"
	}
}

把logstash 和 elasticsearch 都启动 。整个体系就运转起来了

Share