标签：ceph filebeat log filestream fields Ceph 过滤 日志 id
一、方案简述
存储服务组件众多，且容器化多服务实例部署后，日志分散，需要聚合分析，使用 filebeat 来收集节点系统日志、Ceph守护进程实例日志和容器日志，推送至 ELK 集群集中过滤、转换和分析，提高故障排查效率。
二、方案架构图
三、测试环境部署
1、部署单节点ES
容器化部署脚本：
# cat deploy_es.sh
#!/bin/bash
#
docker run \
--name es01-test \
-d --restart=always \
--net elastic \
-p 9200:9200 \
-p 9300:9300 \
-e "discovery.type=single-node" \
docker.elastic.co/elasticsearch/elasticsearch:7.17.12
|
2、部署Kibana
容器化部署脚本：
# cat deploy_kibana.sh
#!/bin/bash
#
docker run \
--name kib01-test \
-d --restart=always \
--net elastic \
-p 5601:5601 \
-e "ELASTICSEARCH_HOSTS=http://es01-test:9200" \
docker.elastic.co/kibana/kibana:7.17.12
|
3、部署Logstash
安装包：
logstash-7.17.12-x86_64.rpm
二进制部署：
rpm -ivh logstash-7.17.12-x86_64.rpm
|
配置示例：
# cat /etc/logstash/conf.d/es-pipeline.conf
input {
beats {
port => 5044
}
}
output {
elasticsearch {
hosts => ["http://172.16.0.1:9200"]
index => "ceph-%{[fields][dc]}-%{[fields][env]}-%{+YYYY.MM.dd}"
# user => "elastic"
# action => "create"
# ilm_enabled => true
# password => "xxxxx"
}
}
# cat /etc/logstash/conf.d/filter.conf
filter {
if "syslog" in [tags] {
grok {
match => {
"message" => [
"^%{SYSLOGBASE} %{GREEDYDATA:log_message}"
]
}
}
}
else if "ceph-log" in [tags] {
grok {
match => {
"message" => [
"^%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE:logsource} %{NOTSPACE:client} %{NOTSPACE:client_ip} %{NOTSPACE} : %{NOTSPACE:program} \[%{NOTSPACE:log_level}\] %{GREEDYDATA:log_message}"
]
}
}
}
else if "ceph-audit" in [tags] {
grok {
match => {
"message" => [
"^%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE:logsource} %{NOTSPACE:client} %{NOTSPACE:client_ip} %{NOTSPACE} : %{NOTSPACE:program} \[%{NOTSPACE:log_level}\] %{GREEDYDATA:log_message}"
]
}
}
}
else if "ceph-mgr" in [tags] {
grok {
match => {
"message" => [
"^%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE}%{SPACE}+%{GREEDYDATA:log_message}"
]
}
}
}
else if "ceph-rgw" in [tags] {
grok {
match => {
"message" => [
"^%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE}%{SPACE}+%{GREEDYDATA:log_message}"
]
}
}
}
else if "ceph-mds" in [tags] {
grok {
match => {
"message" => [
"^%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE}%{SPACE}+%{GREEDYDATA:log_message}"
]
}
}
}
else if "ceph-mon" in [tags] {
grok {
match => {
"message" => [
"^%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE}%{SPACE}+%{GREEDYDATA:log_message}"
]
}
}
}
else if "ceph-osd" in [tags] {
grok {
match => {
"message" => [
"^%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE}%{SPACE}+%{GREEDYDATA:log_message}"
]
}
}
}
}
|
启动服务：
systemctl start logstash
systemctl enable logstash
|
4、部署Filebeat
安装包：
filebeat-7.17.12-x86_64.rpm
二进制部署：
rpm -ivh filebeat-7.17.12-x86_64.rpm
|
配置示例：
# cat /etc/filebeat/filebeat.yml
filebeat.config:
modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template:
settings:
index.number_of_shards: 1
name: "ceph"
pattern: "ceph-*"
enabled: true
overwrite: true
setup.ilm:
enabled: false
#filebeat.autodiscover:
# providers:
# - type: docker
# hints.enabled: true
#processors:
#- add_cloud_metadata: ~
#- add_docker_metadata: ~
#- add_host_metadata: ~
#output.elasticsearch:
# hosts: 172.16.0.1:9200
# username: ''
# password: ''
# index: "ceph-%{[fields.dc]}-%{[fields.env]}-%{+yyyy.MM.dd}"
#
output.logstash:
hosts: ["172.16.0.1:5044"]
# index: "ceph-%{[fields.dc]}-%{[fields.env]}-%{+yyyy.MM.dd}"
setup.kibana:
host: 172.16.0.1:5601
fields:
env: prod
dc: guangming
tags: ["ceph","guangming","prod"]
filebeat.inputs:
# syslog
#- type: filestream
# id: syslog-filestream-id
# enabled: true
# paths:
# - /var/log/syslog
# - /var/log/messages
# fields:
# log_source: syslog
# tags: ["syslog"]
# exclude_lines: ['.*systemd\[\d+\].*','.*systemd-resolved\[\d+\].*','.*ansible-.*','.*filebeat\[\d+\].*']
# ceph
- type: filestream
id: ceph-filestream-id
enabled: true
paths:
- /var/log/ceph/ceph.log
fields:
log_source: ceph-log
tags: ["ceph-log"]
- type: filestream
id: ceph-audit-filestream-id
enabled: true
paths:
- /var/log/ceph/ceph.audit.log
fields:
log_source: ceph-audit
tags: ["ceph-audit"]
- type: filestream
id: ceph-mds-filestream-id
enabled: true
paths:
- /var/log/ceph/ceph-mds.*.log
fields:
log_source: ceph-mds
tags: ["ceph-mds"]
- type: filestream
id: ceph-osd-filestream-id
enabled: true
paths:
- /var/log/ceph/ceph-osd.*.log
fields:
log_source: ceph-osd
tags: ["ceph-osd"]
- type: filestream
id: ceph-mon-filestream-id
enabled: true
paths:
- /var/log/ceph/ceph-mon.*.log
fields:
log_source: ceph-mon
tags: ["ceph-mon"]
- type: filestream
id: ceph-mgr-filestream-id
enabled: true
paths:
- /var/log/ceph/ceph-mgr.*.log
fields:
log_source: ceph-mgr
tags: ["ceph-mgr"]
- type: filestream
id: ceph-rgw-filestream-id
enabled: true
paths:
- /var/log/ceph/ceph-client.rgw.*.log
fields:
log_source: ceph-rgw
tags: ["ceph-rgw"]
- type: filestream
id: ceph-volume-filestream-id
enabled: true
paths:
- /var/log/ceph/ceph-volume.log
fields:
log_source: ceph-volume
tags: ["ceph-volume"]
- type: filestream
id: ceph-volume-systemd-filestream-id
enabled: true
paths:
- /var/log/ceph/ceph-volume-systemd.log
fields:
log_source: ceph-volume-systemd
tags: ["ceph-volume-systemd"]
|
启动服务：
systemctl start filebeat
systemctl enable filebeat
|
容器化部署：
## 配置示例
# cat filebeat.docker.yml
filebeat.config:
modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template:
settings:
index.number_of_shards: 1
name: "ceph"
pattern: "ceph-*"
enabled: true
overwrite: true
setup.ilm:
enabled: false
filebeat.autodiscover:
providers:
- type: docker
hints.enabled: true
processors:
#- add_cloud_metadata: ~
#- add_docker_metadata: ~
#- add_host_metadata: ~
#output.elasticsearch:
# hosts: '172.16.0.1:9200'
# username: ''
# password: ''
# index: "ceph-%{[fields.dc]}-%{[fields.env]}-%{+yyyy.MM.dd}"
output.logstash:
hosts: ["172.16.0.1:5044"]
# index: "ceph-%{[fields.dc]}-%{[fields.env]}-%{+yyyy.MM.dd}"
setup.kibana:
host: "172.16.0.1:5601"
filebeat.inputs:
#- type: filestream
# id: ceph-filestream-id
# enabled: true
# paths:
# - /opt/log/messages
# fields:
# log_source: syslog
# tags: ["syslog"]
# exclude_lines: ['.*systemd\[\d+\].*','.*systemd-resolved\[\d+\].*','.*ansible-.*','.*filebeat\[\d+\].*']
fields:
env: pre
dc: guangming
tags: ["ceph","guangming","pre","docker"]
## 部署脚本
# cat deploy_filebeat.sh
#!/bin/bash
#
docker run -d \
--name=filebeat \
--restart=always \
--net=host \
--user=root \
--volume="$(pwd)/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro" \
--volume="/var/lib/docker/containers:/var/lib/docker/containers:ro" \
--volume="/var/run/docker.sock:/var/run/docker.sock:ro" \
--volume="/var/log:/opt/log:ro" \
docker.elastic.co/beats/filebeat:7.17.12 filebeat -e --strict.perms=false
|
标签：ceph,
filebeat,
log,
filestream,
fields,
Ceph,
过滤,
日志,
id
From： https://www.cnblogs.com/varden/p/17650869.html