Elasticsearch + Logstash + Beats + Kibana

综合练习

下面将所学习到的Elasticsearch + Logstash + Beats + Kibana整合起来做一个综合性的练习,目的就是让学生们能够更加深刻的理解Elastic Stack的使用。

1.1 、流程说明

Elasticsearch + Logstash + Beats + Kibana

  • 应用APP生产日志,用来记录用户的操作
    • [INFO] 2020-05-27 16:49:48 [cn.itcast.dashboard.Main] - DAU|9270|领取优惠券|2020-05-27 12:01:16
    • [INFO] 2020-05-27 16:49:52 [cn.itcast.dashboard.Main] - DAU|2848|加入收藏|2020-05-27 09:06:18
  • 通过Filebeat读取日志文件中的内容,并且将内容发送给Logstash,原因是需要对内容做处理
  • Logstash接收到内容后,进行处理,如分割操作,然后将内容发送到Elasticsearch中
  • Kibana会读取Elasticsearch中的数据,并且在Kibana中进行设计Dashboard,最后进行展示

说明:日志格式、图表、Dashboard都是自定义的。

1.2 、APP说明

APP在生产环境应该是真实的系统,然而,我们现在仅仅的学习,为了简化操作,所以就做数据的模拟生成即可。
业务代码如下:

package cn.itcast.dashboard;

import org.apache.commons.lang3.RandomUtils;
import org.joda.time.DateTime;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class Main {

    private static final Logger LOGGER = LoggerFactory.getLogger(Main.class);

    public static final String[] VISIT = new String[]{"浏览页面", "评论商品", "加入收藏", "加入购物车", "提交订单", "使用优惠券", "领取优惠券", "搜索", "查看订单"};

    public static void main(String[] args) throws Exception {
        while(true){
            Long sleep = RandomUtils.nextLong(200, 1000 * 5);
            Thread.sleep(sleep);
            Long maxUserId = 9999L;
            Long userId = RandomUtils.nextLong(1, maxUserId);
            String visit = VISIT[RandomUtils.nextInt(0, VISIT.length)];
            DateTime now = new DateTime();
            int maxHour = now.getHourOfDay();
            int maxMillis = now.getMinuteOfHour();
            int maxSeconds = now.getSecondOfMinute();
            String date = now.plusHours(-(RandomUtils.nextInt(0, maxHour)))
                    .plusMinutes(-(RandomUtils.nextInt(0, maxMillis)))
                    .plusSeconds(-(RandomUtils.nextInt(0, maxSeconds)))
                    .toString("yyyy-MM-dd HH:mm:ss");

            String result = "DAU|" + userId + "|" + visit + "|" + date;
            LOGGER.info(result);
        }

    }
}
部署:
#打包成jar包,在linux上运行
java -jar test-dashboard-generate-1.0-SNAPSHOT.jar
#运行之后,就可以将日志写入到/test/logs/app.log文件中

1.3、Filebeat

#vim test-dashboard.yml

filebeat.inputs: 
- type: log 
  enabled: true 
  paths: 
  - /test/logs/*.log 
setup.template.settings: 
  index.number_of_shards: 3 
output.logstash: 
  hosts: ["112.126.93.218:5044"]

#启动
./filebeat -e -c test-dashboard.yml

1.4、Logstash

# vim test-dashboard.conf

input {
  beats {
    port => "5044"
    }
}
filter {
    mutate {
        split => {"message"=>"|"}
    }
    mutate {
        add_field => {
            "userId" => "%{message[1]}"
            "visit" => "%{message[2]}"
            "date" => "%{message[3]}"
        }
    }
    mutate {
        convert => {
            "userId" => "integer"
            "visit" => "string"
            "date" => "string"
        }
    }
}
output {
    elasticsearch {
        hosts => [ "112.126.93.218:9200","112.126.93.218:9201","112.126.93.218:9202"]
    }
}
#output {
# stdout { codec => rubydebug }
#}


#启动
./bin/logstash -f test-dashboard.conf

1.5、Kibana

启动Kibana:

#启动
./bin/kibana
#通过浏览器进行访问
http://192.168.40.133:5601/app/kibana

添加Logstash索引到Kibana中:
Elasticsearch + Logstash + Beats + Kibana

1.5.1、时间间隔的柱形图

Elasticsearch + Logstash + Beats + Kibana
说明:x轴是时间,以天为单位,y轴是count数
保存:(my-dashboard-时间间隔的柱形图)
Elasticsearch + Logstash + Beats + Kibana

1.5.2、各个操作的饼图分布

Elasticsearch + Logstash + Beats + Kibana
统计各个操作的数量,形成饼图。
保存:(my-dashboard-各个操作的饼图)
Elasticsearch + Logstash + Beats + Kibana

1.5.3、数据表格

Elasticsearch + Logstash + Beats + Kibana
在数据探索中进行保存,并且保存,将各个操作的数据以表格的形式展现出来。
保存:(my-dashboard-表格)
Elasticsearch + Logstash + Beats + Kibana

1.5.4、制作Dashboard

Elasticsearch + Logstash + Beats + Kibana
在新页面选中add按钮
Elasticsearch + Logstash + Beats + Kibana
Elasticsearch + Logstash + Beats + Kibana

把已经设计好的树状图、饼状图和表格以鼠标单机的方式添加进去

效果图如下
Elasticsearch + Logstash + Beats + Kibana