1、安裝nginx
[root@elasticsearch-01 ~]# yum install nginx2、修改nginx是日志文件以json的格式輸出
##添加
13 log_format json '{"@timestamp":"$time_iso8601",'
14 '"@version":"1",'
15 '"client":"$remote_addr",'
16 '"url":"$uri",'
17 '"status":"$status",'
18 '"domain":"$host",'
19 '"host":"$server_addr",'
20 '"size":$body_bytes_sent,'
21 '"responsetime":$request_time,'
22 '"referer": "$http_referer",'
23 '"ua": "$http_user_agent"'
24 '}';
43 access_log /var/log/nginx/access_json.log json;
3、安裝redis（搭建過程可以參考之前的文章redis主從結構）
爲了節省資源，博主這裏只搭建了一台，只有一台主的服務器。端口：6301密碼：rds6301_paswd
4、編寫logstash.conf配置文件(將Nginx日志存入redis)
input {
file {
path => "/var/log/nginx/access.log"
type => "nginx_102_20"
start_position => "beginning"
stat_interval => "2"
}
}
output {
if[type] =="nginx_102_20"{
redis {
data_type => "list" ##使用發布/訂閱模式
host => "172.17.120.12" ##redis主機地址
db => "6" ##Redis會生成0-15號默認有16個庫,默認連接的是 index=0 的那一個。這16個庫互相之間是獨立的。
port => "6301" ##redis端口號
password => "rds6301_paswd" ##redis密碼
key => "nginx_102_20" ##發布通道名稱
}
}
}5、將數據從redis寫入es
input {
redis {
type => "systemlog"
host => "172.17.120.12"
password => 'rds6301_paswd'
port => "6301"
db => "6"
data_type => "list"
key => "systemlog"
}
}
filter {
json {
source=> "message"
}
}
output {
stdout {}
if[status] =="304"{
exec {
command => "python /root/elk_alarm/count.py err_304 %{proxy_host}"
}
}
elasticsearch {
index => "test" #索引信息
hosts => [ "172.17.120.11:9200"]
}
}
------------------------------------------------------------------
这里agent往redis裏寫數據 server從redis裏讀數據，並且判斷狀態碼304(方便測試而已具體規則自己定義，也支持and or等)發現後執行python腳本。6、自定義報警腳本
[root@elasticsearch-01 ~]# vim /root/elk_alarm/count.py
##大致意思爲發現報警自動往redis增加一條計數器
#!/usr/bin/python
import redis
import sys
f=open("/root/elk_alarm/status.log","a")
f.write(sys.argv[1] +"\n")
f.write(sys.argv[2] +"\n")
f.close()
r =StrictRedis(host='172.17.0.9', port=6306, db=6, password='rds6306_paswd')
count =r.hget(sys.argv[1],sys.argv[2])
ifcount:
r.hset(sys.argv[1],sys.argv[2],int(count)+1)
else:
r.hset(sys.argv[1],sys.argv[2],1)7、還要寫一個報警腳本
[root@elasticsearch-01 ~]# vim /root/elk_alarm/check.py
##大致是發現304超過3時報警，需要配合crontab定時執行，如果在定義的時間內達不到3就清0，如果大于3就報警
#!/usr/bin/python
# -*- coding: UTF-8 -*-
import redis
import smtplib
from email.mime.text import MIMEText
from email.header import Header
r =StrictRedis(host='172.17.0.9', port=6306, db=6, password='rds6306_paswd')
tengine=[
'err_304',
]
sender ='[email protected]'
receivers =['[email protected]']
fori intengine:
print i
print "============================="
fork,v inr.hgetall(i).items():
ifint(v) > 3:
print k,v
print "error"
# 三個參數：第一個爲文本內容，第二個 plain 設置文本格式，第三個 utf-8 設置編碼
mail_msg ="錯誤Upstream:"+" "+k +"次數:"+" "+v
message =MIMEText(mail_msg, 'plain', 'utf-8')
message['From'] =Header(sender)
message['To'] =Header("測試", 'utf-8')
subject ='Log_error_mail'
message['Subject'] =Header(subject, 'utf-8')
try:
smtpObj =smtplib.SMTP('localhost')
smtpObj.sendmail(sender, receivers, message.as_string())
print "郵件發送成功"
except smtplib.SMTPException:
print "Error: 無法發送郵件"
r.hset(i,k,0)
print "-----------------------------------------"
else:
print k,v
print "ok"
print "-----------------------------------------"8、效果展示
關于運維學習、分享、交流，筆者開通了微信公衆號【運維貓】，感興趣的朋友可以關注下，歡迎加入，建立屬于我們自己的小圈子，一起學運維知識。