跳到主要內容

FluentD 存取 File Log


其他文章參考
FluentD 存取 Nginx Access Log (1/2)
FluentD 存取 Nginx Access Log (2/2)

以上是 Nginx + FluentD + (ES|Mongo) Demo
針對access.log 做解析

現在以Log4X 產生的日誌檔作為範例說明
會遇到的問題有
日誌內容會有多行的情況 # multiline
希望每條日誌內容加入 UUID 以便追蹤 # https://github.com/chaeyk/fluent-plugin-add-uuid
使用 Slack 作為通知的通道 # https://github.com/sowawa/fluent-plugin-slack

Log4X Layout Format Example



<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <log4net>
    <appender name="All" type="log4net.Appender.RollingFileAppender">
      <file value="/var/log/web.log" />
      <appendToFile value="true" />
      <rollingStyle value="Size" />
      <datePattern value="yyyy-MM-dd" />
      <maximumFileSize value="5MB" />
      <maxSizeRollBackups value="10" />
      <staticLogFileName value="true" />
      <PreserveLogFileNameExtension value="true" />
      <layout type="log4net.Layout.PatternLayout">
        <conversionPattern value="[%date] [%thread] %level %logger - %message%newline" />
      </layout>
    </appender>
    <root>
      <appender-ref ref="All" />
    </root>
  </log4net>
</configuration>

FluentD Dockerfile



#由於需要在FluentD中產生 UUID 及使用 Slack 作為通知通道
#加裝 fluent-plugin-slack && fluent-plugin-add-uuid 

FROM fluent/fluentd:v1.8.1-1.0

# Use root account to use apk
USER root

# below RUN includes plugin as examples elasticsearch is not required
# you may customize including plugins as you wish
RUN apk add --no-cache --update --virtual .build-deps \
        sudo build-base ruby-dev \
 && apk add mariadb-dev \
 && sudo gem install fluent-plugin-elasticsearch \
 && sudo gem install fluent-plugin-mongo \
 && sudo gem install fluent-plugin-sql \
 && sudo gem install mysql2 -v 0.5.2 \
 && sudo gem install fluent-plugin-add-uuid \
 && sudo gem install fluent-plugin-slack \
 && sudo gem sources --clear-all \
 && apk del .build-deps \
 && rm -rf /home/fluent/.gem/ruby/2.5.0/cache/*.gem

VOLUME ["/fluentd/etc","/fluentd/log","/var/log"]

FluentD configuration



<source>
  @type tail
  path /var/log/web.log
  pos_file /var/log/td-agent/web.log4net.log.pos
  tag log4net.web.sample
  # ! 由於 multiline 的因素避免最後一列會等待新輸入而暫停解析
  multiline_flush_interval 10s
  <parse>
    @type multiline
    format_firstline  /\[\d{4}-\d{1,2}-\d{1,2}/
    format1 /^\[(?<logdt>[^\]]*)\] \[(?<thread>[^ ]*)\] (?<level>[^ ]*) (?<logger>[^ ]*) - (?<message>.*)/
  </parse>
</source>
<filter log4net.web.sample>
  # 只針對 Log Level = ERROR 寫入 Mongo & Push Slack
  @type grep
  <regexp>
    key level
    pattern /ERROR/
  </regexp>
</filter>
<filter log4net.web.sample>
  @type adduuid
  key _uuid
</filter>
<match log4net.web.sample>
  @type copy
  <store>
    @type mongo
    # 略 ...
  </store>
  <store>
    # https://github.com/sowawa/fluent-plugin-slack
    @type slack  
    token xoxb- # bot user oAuth access token
    username fluentd 
    webhook_url https://hooks.slack.com/services/  # webhook_url
    title %s 
    title_keys tag
    message %s %s
    message_keys logdt,_uuid
  </store>
</match>

留言

張貼留言

這個網誌中的熱門文章

Grafana Dashboard 建立

建立自己的 Dashboard # 由於 intelligent sense 相當不錯，輸入關鍵字他會帶出 metric label # 另外可參考 https://prometheus.io/docs/prometheus/latest/querying/basics/ Prometheus Query # 或是直接拿其他已建立的Dashboard 可複製到新的 Dashboard ex: node_memory_MemTotal_bytes # 取伺服器記憶體容量資料 # 過濾條件在{}加入 ex: node_memory_MemTotal_bytes{instance="${server 1}:9100"} # 要取特定伺服器資料 # Setting 中設定 Variables ex: node_memory_MemTotal_bytes{instance=~"$node"} # 變數名稱 node 建立 Alert ．Visualization 必須是Graph
張貼留言
閱讀完整內容

FluentD 實作 Nginx Access Log

實作 Nginx Access Log 透過 FluentD 收集 /var/log/nginx/nginx_web.access.log 日誌 過濾不必要的紀錄 輸出到MongoDB & Elasticsearch 延伸閱讀 FluentD 參數說明 FluentD 實作 Nginx Access Log 補充 fluent.conf # workers parameter for specifying the number of workers <system> workers 1 </system> <worker 0> <source> @type tail path /var/log/nginx/nginx_web.access.log pos_file /var/log/td-agent/nginx_web.access.log.pos tag nginx.web.access format /^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<logtime>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")(?: "(?<custom_field1>[^\"]*)" "(?< custom_field2>[^\"]*)" "(?< custom_field3>[^\"]*)")?$/ time_format %d/%b/%Y:%H:%M:%S %z </source> # 濾掉不必要的存取紀錄 <fil...
張貼留言
閱讀完整內容

FluentD 實作 Error Log

FluentD 實作 Error Log 本篇將介紹使用 DotNet 專案 log4net 套件，紀錄的 log 針對 Error Level 的訊息透過FluentD 提取出來 在紀錄中 增加 trace ID 設入 MongoDB , 及加入 Slack 通知 延伸閱讀 FluentD 參數說明 FluentD 實作 Nginx Access Log FluentD 實作 Nginx Access Log 補充 log4net <?xml version="1.0" encoding="utf-8" ?> <configuration> <log4net> <appender name="All" type="log4net.Appender.RollingFileAppender"> <file value="/var/log/my.log" /> <appendToFile value="true" /> <rollingStyle value="Size" /> <datePattern value="yyyy-MM-dd" /> <maximumFileSize value="5MB" /> <maxSizeRollBackups value="10" /> <staticLogFileName value="true" /> <PreserveLogFileNameExtension value="true" /> <layout type="log4net.Layout.PatternLayout"> <conversionPattern value="[%date] [...
張貼留言
閱讀完整內容