ELK详解tomcat日志

实验环境

192.168.170.8  node1 kibana
192.168.170.9  node2 els
192.168.170.10 node3 logstash1
192.168.170.11 node4 redis
192.168.170.12 node5 logstash2
192.168.170.22 node6 haproxy+web

保证所有主机的主机名都能被解析，同时保证ntp时间是同步的，同时关闭selinux和防火墙功能。

部署tomcat

一：安装java

[root@node6 ~]# rpm -ivh jdk-8u131-linux-x64.rpm

二：部署tomcat

[root@node6 ~]# wget http://archive.apache.org/dist/tomcat/tomcat-8/v8.0.38/bin/apache-tomcat8.0.38.tar.gz
[root@node6 ~]# mkdir /apps
[root@node6 apps]# tar xvf apache-tomcat-8.0.36.tar.gz
[root@node6 apps]# ln -sv /apps/apache-tomcat-8.0.38/ /apps/tomcat
[root@node6 apps]# mkdir /apps/tomcat/webapps/tomcatweb
[root@node6 apps]# echo "Tomcat Web Page" > /apps/tomcat/webapps/tomcatweb/index.html

三：启动与关闭tomcat

[root@node6 conf]# /apps/tomcat/bin/catalina.sh start
[root@node6 conf]# /apps/tomcat/bin/catalina.sh stop

 测试tomcat页面

tomcat日志转成json格式：

[root@node6 conf]# vim /apps/tomcat/conf/server.xml
pattern="{"client":"%h",  "client user":"%l",   "authenticated":"%u",   "access time":"%t",     "method":"%r",   "status":"%s",  "send bytes":"%b",  "Query?string":"%q",  "partner":"%{Referer}i",  "Agent version":"%{User-Agent}i"}"/>

2、重启tomcat:

[root@node6 conf]# /apps/tomcat/bin/catalina.sh stop
[root@node6 conf]# rm -rf /apps/tomcat/logs/
[root@node6 conf]# /apps/tomcat/bin/catalina.sh start

通过后台方式查看tomcat启动状态

[root@node6 conf]# tail -f /apps/tomcat/logs/catalina.out 

客户端用curl命令访问

[root@node5 ~]# curl http://192.168.170.22:8080/tomcatweb/index.html
Tomcat Web Page

验证tomcat日志转json格式是否正常

[root@node6 conf]# tail -f /apps/tomcat/logs/tomcat_access_log.2019-04-16.log 
{"client":"172.17.1.116",  "client user":"-",   "authenticated":"-",   "access time":"[16/Apr/2019:16:29:53 +0800]",     "method":"GET /favicon.ico HTTP/1.1",   "status":"200",  "send bytes":"21630",  "Query?string":"",  "partner":"http://192.168.170.22:8080/tomcatweb/",  "Agent version":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3724.8 Safari/537.36"}

配置filebeat收集tomcat日志：

[root@node6 conf]# vi /etc/filebeat/filebeat.yml
- input_type: log
  paths:
    - /apps/tomcat/logs/tomcat_access_log.*.txt
  document_type: tomcat-accesslog-0022

重启filebeat并查看启动状态

[root@node6 conf]# systemctl restart  filebeat
[root@node6 conf]# systemctl status filebeat

配置logstash2收集tomcat日志传给redis

[root@node5 conf.d]# vim /etc/logstash/conf.d/filebeats.conf #增加如下内容
if [type] == "tomcat-accesslog-0022" {
    redis {
        data_type => "list"
        host => "192.168.170.11"
        port => "6379"
        key => "tomcat-accesslog-0022"
        db => "9"
        password => "123456"
        codec => "json"
    }
}

重启logstash并通过后台日志查看重启状态

[root@node5 conf.d]# systemctl restart logstash
[root@node5 conf.d]# tail -f /var/log/logstash/logstash-plain.log

客户端压测访问tomcat页面

[root@node6 ~]# ab -n100 -c10 http://192.168.170.22:8080/tomcatweb/

验证redis中是否有数据输出

[root@node4 ~]# redis-cli -h 192.168.170.11 -a 123456
Warning: Using a password with '-a' or '-u' option on the command line interface may not be safe.
192.168.170.11:6379> select 9
OK
192.168.170.11:6379[9]> keys *
1) "tomcat-accesslog-0022"
192.168.170.11:6379[9]> keys *
1) "tomcat-accesslog-0022"
192.168.170.11:6379[9]> 

配置logstash1从redis取出并写入至elasticsearch

[root@node3 ~]# vi  /etc/logstash/conf.d/redis-els.conf  #增加如下内容
input {
	redis {
		data_type => "list"
		host => "192.168.170.11"
		port => "6379"
		key => "tomcat-accesslog-0022"
		db => "9"
		password => "123456"
		codec => "json"
	}
}
output {
	if [type] == "tomcat-accesslog-0018" {
		elasticsearch {
			hosts => ["192.168.170.9:9200"]
			index => "tomcat-accesslog-0022-%{+YYYY.MM.dd}"
		}
	}
}

重启logstash服务：

[root@node3 conf.d]# systemctl restart logstash
[root@node3 conf.d]# tail -f /var/log/logstash/logstash-plain.log

压测访问tomcat并验证日志

[root@node6 ~]# ab -n100 -c10 http://192.168.170.22:8080/tomcatweb/

将tomcat访问日志添加至kibana并验证