flume使用入门

0755mx

　　1.下载apache-flume-1.4.0-bin.tar.gz并解压

tar -xzvf apache-flume-1.4.0-bin.tar.gz
cd apache-flume-1.4.0-bin
　　
2.创建一个简单的flume配置文件，内容如下：
　　vi a1.conf

# Name the components on this agent
a1.sources = r1
a1.sinks = k1
a1.channels = c1
# Describe/configure the source
a1.sources.r1.type = netcat
a1.sources.r1.bind = localhost
a1.sources.r1.port = 44444
# Describe the sink
a1.sinks.k1.type = logger
# Use a channel which buffers events in memory
a1.channels.c1.type = memory
a1.channels.c1.capacity = 1000
a1.channels.c1.transactionCapacity = 100
# Bind the source and sink to the channel
a1.sources.r1.channels = c1
a1.sinks.k1.channel = c1

　　3.启动flumeng

./bin/flume-ng agent --conf conf --conf-file a1.conf --name a1 -Dflume.root.logger=INFO,console
　　4.在另一个控制台，启用telnet
　　telnet localhost 44444
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
hello world
OK
　　
将会在步骤3中的控制台中看到flume接收到的消息。
　　在步骤3中的控制台按ctrl+C，中止测试。
　　5.修改a1的来源为从日志文件中获取数据
　　修改后的内容如下：

# Name the components on this agent
a1.sources = r1
a1.sinks = k1
a1.channels = c1
# Describe/configure the source
a1.sources.r1.type = exec
a1.sources.r1.command = tail -F /var/log/secure
# Describe the sink
a1.sinks.k1.type = logger
# Use a channel which buffers events in memory
a1.channels.c1.type = memory
a1.channels.c1.capacity = 1000
a1.channels.c1.transactionCapacity = 100
# Bind the source and sink to the channel
a1.sources.r1.channels = c1
a1.sinks.k1.channel = c1

　　6.再次启动flumeng

./bin/flume-ng agent --conf conf --conf-file a1.conf --name a1 -Dflume.root.logger=INFO,console
　　
打开新的ssh客户端，输入用户名密码登录本服务器，将会看到flume有日志产生
　　但看到的日志不完整
　　/var/log/secure中的内容为：
　　Mar 12 14:50:21 web5 sshd[9856]: Accepted password for root from 10.0.2.11 port 1135 ssh2
Mar 12 14:50:21 web5 sshd[9856]: pam_unix(sshd:session): session opened for user root by (uid=0)
　　flume控制台内容为：
2014-03-12 06:50:21,571 (SinkRunner-PollingRunner-DefaultSinkProcessor) [INFO - org.apache.flume.sink.LoggerSink.process(LoggerSink.java:70)] Event: { headers:{} body: 4D 61 72 20 31 32 20 31 34 3A 35 30 3A 32 31 20 Mar 12 14:50:21  }
2014-03-12 06:50:25,575 (SinkRunner-PollingRunner-DefaultSinkProcessor) [INFO - org.apache.flume.sink.LoggerSink.process(LoggerSink.java:70)] Event: { headers:{} body: 4D 61 72 20 31 32 20 31 34 3A 35 30 3A 32 31 20 Mar 12 14:50:21  }
　　7.为flume添加个文件sink
　　修改后的a1.conf文件为：

# Name the components on this agent
a1.sources = r1
a1.sinks = k1 k2
a1.channels = c1
# Describe/configure the source
a1.sources.r1.type = exec
a1.sources.r1.command = tail -F /var/log/secure
# Describe the sink
a1.sinks.k1.type = logger
a1.sinks.k2.type = file_roll
a1.sinks.k2.sink.directory = /tmp/flume
# Use a channel which buffers events in memory
a1.channels.c1.type = memory
a1.channels.c1.capacity = 1000
a1.channels.c1.transactionCapacity = 100
# Bind the source and sink to the channel
a1.sources.r1.channels = c1
a1.sinks.k1.channel = c1
a1.sinks.k2.channel = c1

　　重新启动flume后，会在/tmp/flume下生成数据
　　查看/tmp/flume下的文件，和flume控制台的数据，感觉二者把日志的数据分开了，
一部分日志数据显示在控制台，一部分数据保存到了/tmp/flume下的文件里
　　
/var/log/secure中内容为：
　　Mar 12 14:50:21 web5 sshd[9856]: Accepted password for root from 10.0.2.11 port 1135 ssh2
Mar 12 14:50:21 web5 sshd[9856]: pam_unix(sshd:session): session opened for user root by (uid=0)
Mar 12 14:59:36 web5 sshd[10350]: Accepted password for root from 10.0.2.11 port 1193 ssh2
Mar 12 14:59:36 web5 sshd[10350]: pam_unix(sshd:session): session opened for user root by (uid=0)
Mar 12 15:00:56 web5 sshd[10350]: Received disconnect from 10.0.2.11: 11: Disconnect requested by Windows SSH Client.
Mar 12 15:00:56 web5 sshd[10350]: pam_unix(sshd:session): session closed for user root
　　
/tmp/flume下的文件约30秒产生一个。
　　
8.为flume添加个文件channel
　　修改后的a1.conf文件为：
　　# Name the components on this agent

a1.sources = r1
a1.sinks = k1 k2
a1.channels = c1 c2
# Describe/configure the source
a1.sources.r1.type = exec
a1.sources.r1.command = tail -F /var/log/secure
# Describe the sink
a1.sinks.k1.type = logger
a1.sinks.k2.type = file_roll
a1.sinks.k2.sink.directory = /tmp/flume
# Use a channel which buffers events in memory
a1.channels.c1.type = memory
a1.channels.c1.capacity = 1000
a1.channels.c1.transactionCapacity = 100
a1.channels.c2.type = memory
a1.channels.c2.capacity = 1000
a1.channels.c2.transactionCapacity = 100
# Bind the source and sink to the channel
a1.sources.r1.channels = c1 c2
a1.sources.r1.selector.type = replicating
a1.sinks.k1.channel = c1
a1.sinks.k2.channel = c2

　　
 修改后，控制台和/tmp/flume中的内容，与日志就对应上了。