ELK 通过地理位置显示访问来源
[*]Elasticsearch是实时全文搜索和分析引擎，提供搜集、分析、存储数据三大功能；是一套开放REST和JAVA API等结构提供高效搜索功能，可扩展的分布式系统。它构建于Apache Lucene搜索引擎库之上。
[*]Logstash是一个用来搜集、分析、过滤日志的工具。它支持几乎任何类型的日志，包括系统日志、错误日志和自定义应用程序日志。它可以从许多来源接收日志，这些来源包括 syslog、消息传递（例如 RabbitMQ）和JMX，它能够以多种方式输出数据，包括电子邮件、websockets和Elasticsearch。
[*]Kibana是一个基于Web的图形界面，用于搜索、分析和可视化存储在 Elasticsearch指标中的日志数据。它利用Elasticsearch的REST接口来检索数据，不仅允许用户创建他们自己的数据的定制仪表板视图，还允许他们以特殊的方式查询和过滤数据。
Elasticsearch Logstash Kibana的安装都比较简单，到官网下最新版本，我所用的版本是5.2.2，这里就不详细讲解安装过程，不会的可以网上找。
1, 将地图更改成高德使用中文显示
# vim /usr/local/kibana-5.2.2-linux-x86_64/config/kibana.yml
tilemap.url: 'http://webrd02.is.autonavi.com/appmaptile?lang=zh_cn&size=1&scale=1&style=7&x={x}&y={y}&z={z}'
将日志格式定义为json格式
# vim /usr/local/nginx/conf/nginx.conf
log_format logstash_json '{"@timestamp":"$time_iso8601",'
'"host":"$server_addr",'
'"clientip":"$remote_addr",'
'"size":$body_bytes_sent,'
'"responsetime":$request_time,'
'"upstreamtime":"$upstream_response_time",'
'"upstreamhost":"$upstream_addr",'
'"http_host":"$host",'
'"url":"$uri",'
'"xff":"$http_x_forwarded_for",'
'"referer":"$http_referer",'
'"agent":"$http_user_agent",'
'"status":"$status"}';
2,查看nginx的访问日志信息
# less /usr/local/nginx/logs/access.log
https://s2.运维网.com/wyfs02/M02/8E/C4/wKiom1jKW8HBPNduAABri7USHJI101.png-wh_500x0-wm_3-wmp_4-s_4026007558.png
3,GeoLite2下载地址
wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz
https://s4.运维网.com/wyfs02/M01/8E/C2/wKiom1jKWdWCId9oAAA4JxSKvp4193.png-wh_500x0-wm_3-wmp_4-s_1406357612.png
4,配置nginx log的匹配方式
#vim /opt/logstash/vendor/bundle/jruby/1.9/gems/logstah-patterns-core-0.3.0/patterns/grok-patterns
URIPARM1 9$.+!*'|(){},~@#%&/=:;_?\-\[\]]*URIPATH1 (?:/9$.+!*'(){},~:;=@#%&_\- ]*)+URI1 (%{URIPROTO}://)?(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?NGINXACCESS %{IPORHOST:remote_addr} - (%{USERNAME:user}|-) \[%{HTTPDATE:log_timestamp}\] %{HOSTNAME:http_host} %{WORD:request_method} \"%{URIPATH1:uri}\" \"%{URIPARM1:param}\" %{BASE10NUM:http_status} (?:%{BASE10NUM:body_bytes_sent}|-) \"(?:%{URI1:http_referrer}|-)\" (%{BASE10NUM:upstream_status}|-) (?:%{HOSTPORT:upstream_addr}|-) (%{BASE16FLOAT:upstream_response_time}|-) (%{BASE16FLOAT:request_time}|-) (?:%{QUOTEDSTRING:user_agent}|-) \"(%{IPV4:client_ip}|-)\" \"(%{WORD:x_forword_for}|-)\"
5,编写logstash的脚本文件，将Nginx日志往Redis写
# vim /usr/local/logstash-5.2.2/conf.d/logstash-nginx.conf
input {
file {
path => ["/usr/local/nginx/logs/access.log"]
type => "logstash-prod-nginx"
start_position => "beginning"
codec => json
}
}
filter {
grok {
match => { "message" => "%{NGINXACCESS}" }
}
}
output {
stdout { codec => rubydebug }
redis {
host => "1.1.1.1"
port => "6379"
data_type => 'list'
key => 'logstash-prod-nginx'
}
}
6,将Nginx的日志从Redis写入到ES中
# vim /usr/local/logstash-5.2.2/conf.d/logstash-es.conf
input {
redis {
host => "1.1.1.1"
port => "6379"
data_type => "list"
key => "logstash-prod-nginx"
type => "redis-input"
#codec => "json"
}
}
filter {
if == "logstash-prod-nginx" {
geoip {
source => "clientip"
target => "geoip"
database => "/usr/local/logstash-5.2.2/etc/GeoLite2-City.mmdb"
add_field => [ "", "%{}" ]
add_field => [ "", "%{}"]
}
mutate {
convert => [ "", "float"]
}
}
}
output {
# stdout { codec => rubydebug }
if == "logstash-prod-nginx" {
elasticsearch {
hosts => "1.1.1.1:9200"
manage_template => true
index => "logstash-prod-nginx-%{+YYYY.MM.dd}"
}
}
}
7,登陆kibana页面输入地址：http://127.0.0.1:5601,可见如下图片
https://s5.运维网.com/wyfs02/M02/8E/C2/wKiom1jKWraB-VMGAAFtXln2LCo540.png-wh_500x0-wm_3-wmp_4-s_1666522526.png
填入在logstash里写的index
https://s1.运维网.com/wyfs02/M00/8F/C3/wKioL1jsbiKjmPdbAAGLQisWRBY778.png-wh_500x0-wm_3-wmp_4-s_373361357.png
添加好后，就可以看下如下图片，日志就已被收集
https://s4.运维网.com/wyfs02/M02/8E/C0/wKioL1jKWxzD45eBAACplKLx8Co513.png-wh_500x0-wm_3-wmp_4-s_4275355097.png
添加访问来源地理位置
https://s4.运维网.com/wyfs02/M02/8E/C0/wKioL1jKWzHjgfEEAAIaHPELdpg456.png-wh_500x0-wm_3-wmp_4-s_3683999187.png
就可以看到我们的应用来自各个区域的访问来源
https://s4.运维网.com/wyfs02/M00/8E/C0/wKioL1jKWzKz13tlAANgwtex2Rg103.png-wh_500x0-wm_3-wmp_4-s_3735963498.png
页:
[1]