Nyob zoo, kuv lub npe yog Eugene, Kuv yog B2B pab pawg thawj coj ntawm Citymobil. Ib lub luag haujlwm ntawm peb pab neeg yog los txhawb kev koom ua ke rau kev xaj tsheb tavxij los ntawm cov neeg koom tes, thiab txhawm rau ua kom muaj kev pabcuam ruaj khov, peb yuav tsum nco ntsoov nkag siab tias muaj dab tsi tshwm sim hauv peb cov microservices. Thiab rau qhov no koj yuav tsum tau saib xyuas cov cav tas li.
Hauv Citymobil, peb siv ELK pawg (ElasticSearch, Logstash, Kibana) ua haujlwm nrog cov cav, thiab cov ntaub ntawv tuaj txog muaj ntau heev. Nrhiav cov teeb meem hauv qhov kev thov loj no uas yuav tshwm sim tom qab kev xa tawm ntawm cov cai tshiab yog qhov nyuaj heev. Thiab rau lawv qhov pom kev pom, Kibana muaj ntu Dashboard.
Muaj ob peb tsab xov xwm ntawm Habre nrog cov piv txwv ntawm yuav ua li cas teeb tsa ELK pawg kom tau txais thiab khaws cov ntaub ntawv, tab sis tsis muaj cov ntaub ntawv cuam tshuam txog kev tsim Dashboard. Yog li ntawd, kuv xav qhia yuav ua li cas los tsim qhov pom kev sawv cev ntawm cov ntaub ntawv raws li cov ntaub ntawv tuaj hauv Kibana.
hloov
Txhawm rau ua kom pom tseeb, Kuv tsim Docker duab nrog ELK thiab Filebeat. Thiab muab tso rau hauv ib lub thawv me me hauv Go, uas rau peb qhov piv txwv yuav tsim cov ntawv xeem. Kuv yuav tsis piav qhia meej txog kev teeb tsa ntawm ELK, muaj txaus sau txog nws ntawm HabrΓ©.
Clone lub config repository docker-compose thiab ELK nqis, thiab tso nws nrog cov lus txib docker-compose up. Intentionally tsis ntxiv tus yuam sij -dkom pom kev nce qib ntawm ELK pawg.
git clone https://github.com/et-soft/habr-elk
cd habr-elk
docker-compose up
Yog tias txhua yam raug teeb tsa kom raug, ces peb yuav pom qhov nkag hauv cov cav (tej zaum tsis yog tam sim ntawd, txheej txheem ntawm kev tso lub thawv nrog tag nrho pawg yuav siv sijhawm ob peb feeb):
{"type":"log","@timestamp":"2020-09-20T05:55:14Z","tags":["info","http","server","Kibana"],"pid":6,"message":"http server running at http://0:5601"}
Los ntawm qhov chaw nyob localhost:5061 Kibana yuav tsum qhib.
Tib yam uas peb yuav tsum tau teeb tsa yog tsim qhov Index Pattern rau Kibana nrog cov ntaub ntawv hais txog cov ntaub ntawv dab tsi los tso saib. Txhawm rau ua qhov no, peb yuav ua tiav qhov kev thov curl lossis ua cov haujlwm ua haujlwm hauv graphical interface.
$ curl -XPOST -D- 'http://localhost:5601/api/saved_objects/index-pattern'
-H 'Content-Type: application/json'
-H 'kbn-xsrf: true'
-d '{"attributes":{"title":"logstash-*","timeFieldName":"@timestamp"}}'
Tsim ib qho Index Pattern ntawm GUI
Txhawm rau teeb tsa, xaiv Discover seem hauv cov ntawv qhia zaub mov sab laug, thiab mus rau nplooj ntawv Index qauv tsim.
Los ntawm txhaj rau ntawm lub pob "Tsim index qauv", peb mus rau nplooj ntawv index creation. Hauv "Index qauv npe" teb, sau "logstash-*". Yog tias txhua yam raug teeb tsa kom raug, hauv qab Kibana yuav qhia cov indexes uas poob rau hauv txoj cai.
Nyob rau nplooj ntawv tom ntej, xaiv qhov tseem ceeb teb nrog lub sij hawm, nyob rau hauv peb cov ntaub ntawv nws yog @timestamp.
Qhov no yuav coj mus rau nplooj ntawv teeb tsa qhov ntsuas, tab sis tsis muaj qhov xav tau ntxiv los ntawm peb lub sijhawm no.
Tam sim no peb tuaj yeem mus rau ntu Discover dua, qhov twg peb yuav pom cov ntawv nkag.
dashboard
Hauv cov ntawv qhia zaub mov sab laug, nyem rau ntawm Dashboard tsim ntu thiab mus rau nplooj ntawv sib thooj.
Nyem rau ntawm "Tsim tshiab dashboard" thiab mus rau nplooj ntawv ntxiv cov khoom rau Dashboard.
Nyem rau ntawm lub pob "Tsim tshiab", thiab lub kaw lus yuav hais kom koj xaiv hom ntaub ntawv tso saib. Kibana muaj coob tus ntawm lawv, tab sis peb yuav saib los ntawm kev tsim cov duab sawv cev ntawm "Ntaus Bar" thiab ib lub tabular "Cov Ntaub Ntawv Table". Lwm hom kev nthuav qhia tau teeb tsa hauv ib txoj kev zoo sib xws.
Qee cov khoom muaj npe B thiab E, uas txhais tau hais tias hom ntawv yog kev sim lossis hauv kev sim beta. Sij hawm dhau mus, hom ntawv yuav hloov lossis ploj tag nrho los ntawm Kibana.
ntsug bar
Rau qhov piv txwv "Vertical Bar", cia peb tsim cov histogram ntawm qhov piv ntawm kev ua tiav thiab tsis ua tiav cov xwm txheej ntawm peb cov kev pabcuam. Thaum kawg ntawm kev teeb tsa, peb tau txais cov duab hauv qab no:
Peb yuav faib txhua qhov kev thov nrog cov xwm txheej teb <400 ua tiav, thiab>= 400 yog qhov teeb meem.
Txhawm rau tsim daim ntawv "Vertical Bar", peb yuav tsum xaiv cov ntaub ntawv. Xaiv qhov Index Pattern uas peb tau tsim ua ntej.
Los ntawm lub neej ntawd, ib daim duab zoo ib yam yuav tshwm sim tom qab xaiv cov ntaub ntawv. Cia peb teeb.
Hauv "Buckets" thaiv, nias lub pob "Ntxiv", xaiv "X-asis" thiab teeb tsa X axis. Cia peb tso tseg lub sijhawm ntawm cov ntawv nkag hauv lub cav nrog nws. Hauv "Aggregation" teb, xaiv "Histogram Hnub", thiab hauv "Field" xaiv "@timestamp", qhia lub sijhawm teb. Cia peb tawm "Qhov tsawg kawg nkaus" nyob rau hauv lub xeev "Auto", thiab nws yuav hloov kho rau peb cov zaub.
Los ntawm txhaj rau ntawm lub pob "Hloov tshiab", peb yuav pom daim duab nrog tus lej thov txhua 30 vib nas this.
Tam sim no cia peb teeb tsa cov kab raws li Y-axis.
Cia peb hloov qhov "Aggregation" tus nqi rau "Sum Bucket", uas yuav tso cai rau peb muab cov ntaub ntawv ua tiav thiab tsis ua tiav. Nyob rau hauv lub thoob -> Aggregation thaiv, xaiv cov aggregation los ntawm "Filters" thiab teem lub filtering los ntawm "statusCode>= 400". Thiab nyob rau hauv "Kev cai daim ntawv lo", peb qhia peb lub npe ntawm qhov taw qhia kom nkag siab ntau ntxiv hauv cov lus dab neeg ntawm daim duab thiab hauv cov npe dav dav.
Los ntawm txhaj rau "Hloov tshiab" khawm nyob rau hauv qhov chaw thaiv, peb yuav tau txais ib daim duab nrog cov teeb meem thov.
Yog tias koj nyem rau ntawm lub voj voog ib sab ntawm cov lus dab neeg, lub qhov rais yuav tshwm sim uas koj tuaj yeem hloov xim ntawm txhua kab.
Tam sim no cia peb ntxiv cov ntaub ntawv ntawm kev thov ua tiav rau daim ntawv. Hauv seem "Metrics", nyem lub pob "Ntxiv" thiab xaiv "Y-axis".
Hauv qhov tsim metric, peb ua tib qhov chaw raws li kev thov yuam kev. Tsuas yog hauv cov lim peb teev "statusCode <400".
Los ntawm kev hloov cov xim ntawm kab ntawv tshiab, peb tau txais cov duab ntawm qhov piv ntawm cov teeb meem thiab kev thov ua tiav.
Los ntawm txhaj rau "Txuag" khawm nyob rau sab saum toj ntawm lub vijtsam thiab qhia lub npe, peb yuav pom thawj daim ntawv qhia ntawm Dashboard.
Cov Ntaub Ntawv Cov Lus
Tam sim no xav txog lub tabular saib "Cov ntaub ntawv". Cia peb tsim ib lub rooj nrog cov npe ntawm tag nrho cov URLs uas tau thov thiab tus naj npawb ntawm cov kev thov. Raws li nrog Vertical Bar piv txwv, peb xub xaiv cov ntaub ntawv qhov chaw.
Tom qab ntawd, lub rooj nrog ib kab yuav tshwm rau ntawm qhov screen, uas qhia tag nrho cov kev thov rau lub sijhawm xaiv.
Peb tsuas yog hloov qhov "Buckets" thaiv. Nyem rau "Ntxiv" khawm thiab xaiv "Split rows".
Hauv qhov "Aggregation" teb, xaiv "Cov ntsiab lus". Thiab nyob rau hauv qhov tshwm sim "Field" xaiv "url.keyword".
Los ntawm kev qhia tus nqi "Url" nyob rau hauv "Custom label" teb thiab nyem "Hloov tshiab", peb yuav tau txais cov lus xav tau nrog cov naj npawb ntawm kev thov rau txhua qhov URLs rau lub sijhawm xaiv.
Nyob rau sab saum toj ntawm lub vijtsam, nyem lub pob "Txuag" dua thiab qhia lub npe ntawm lub rooj, piv txwv li Urls. Cia peb rov qab mus rau Dashboard thiab pom ob qho kev pom tsim.
Ua haujlwm nrog Dashboard
Thaum tsim Dashboard, peb tsuas yog teeb tsa lub ntsiab saib tsis nyob hauv cov khoom teeb tsa. Nws ua rau tsis muaj kev nkag siab los qhia cov ntaub ntawv rau cov lim dej hauv cov khoom, piv txwv li, "hnub tim ntau", "filtering by useragent", "filtering by request country", thiab lwm yam. Nws yog qhov yooj yim dua los piav qhia lub sijhawm xav tau lossis teeb tsa qhov tsim nyog lim hauv cov lus nug vaj huam sib luag, uas nyob saum cov khoom.
Cov ntxaij lim dej ntxiv rau ntawm lub vaj huam sib luag no yuav raug siv rau tag nrho Dashboard, thiab tag nrho cov khoom tso tawm yuav raug rov ua dua tshiab raws li cov ntaub ntawv lim dej tiag tiag.
xaus
Kibana yog lub cuab yeej muaj zog uas tso cai rau koj pom cov ntaub ntawv hauv txoj kev yooj yim. Kuv sim qhia qhov chaw ntawm ob lub ntsiab ntawm cov zaub. Tab sis lwm hom yog configured nyob rau hauv ib txoj kev zoo sib xws. Thiab qhov kev nplua nuj ntawm qhov chaw uas kuv tau tso tseg "tom qab lub scenes" yuav tso cai rau koj hloov kho cov kab kos kom haum rau koj cov kev xav tau.
Tau qhov twg los: www.hab.com