Still reading logs on the command line? Use kibana, visual log analysis yyds!

Recently I put mall Project upgrade Support SpringBoot 2.7.0, At the same time, the whole set of ELK Log collection system . I find that every upgrade Kibana The interface will change to some extent , Become more modern ！ Let's talk today mall The log collection mechanism of the project , Used SpringBoot The latest version supported ELK, I hope that's helpful ！

ELK Build log collection system

First we need to build ELK Log collection system , It's used here in Docker How to install in the environment .

• Install and run Elasticsearch Containers , Use the following command ;

docker run -p 9200:9200 -p 9300:9300 --name elasticsearch \
-e "discovery.type=single-node" \
-e "cluster.name=elasticsearch" \
-e "ES_JAVA_OPTS=-Xms512m -Xmx1024m" \
-v /mydata/elasticsearch/plugins:/usr/share/elasticsearch/plugins \
-v /mydata/elasticsearch/data:/usr/share/elasticsearch/data \
-d elasticsearch:7.17.3

Copy

• When you start up, you'll find /usr/share/elasticsearch/data The directory does not have access rights , It just needs to be modified /mydata/elasticsearch/data Directory permissions , Just restart it ;

chmod 777 /mydata/elasticsearch/data/

Copy

• Install and run Logstash Containers , Use the following command ,logstash.conf File address ：https://github.com/macrozheng/mall/blob/master/document/elk/logstash.conf

docker run --name logstash -p 4560:4560 -p 4561:4561 -p 4562:4562 -p 4563:4563 \
--link elasticsearch:es \
-v /mydata/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf \
-d logstash:7.17.3

Copy

• Enter the inside of the container , install json_lines plug-in unit ;

docker exec -it logstash /bin/bash
logstash-plugin install logstash-codec-json_lines

Copy

• Install and run Kibana Containers , Use the following command ;

docker run --name kibana -p 5601:5601 \
--link elasticsearch:es \
-e "elasticsearch.hosts=http://es:9200" \
-d kibana:7.17.3

Copy

• ELK After the log collection system is started , You can access Kibana The interface of , Access address ：http://192.168.3.105:5601

Principle of log collection

The principle of the log collection system is as follows , First, application integration Logstash plug-in unit , adopt TCP towards Logstash Transport log .Logstash After receiving the log, store the log in... According to the log type Elasticsearch On different indexes ,Kibana from Elasticsearch Read logs from , And then we can go in Kibana Visual log analysis in , The specific flow chart is as follows .

Here, logs are divided into the following four types , Convenient view ：

• The debug log （mall-debug）： be-all DEBUG Logs above level ;
• Error log （mall-error）： be-all ERROR The level of log ;
• Business log （mall-business）：com.macro.mall Everything under the bag DEBUG Logs above level ;
• Log （mall-record）：com.macro.mall.tiny.component.WebLogAspect All under the class DEBUG Logs above level , This class is used to count interface access information AOP Section class .

Start the application

You have to take mall Three applications of the project are launched , adopt --link logstash:logstash Connect to Logstash.

mall-admin

docker run -p 8080:8080 --name mall-admin \
--link mysql:db \
--link redis:redis \
--link logstash:logstash \
-v /etc/localtime:/etc/localtime \
-v /mydata/app/admin/logs:/var/logs \
-d mall/mall-admin:1.0-SNAPSHOT

Copy

mall-portal

docker run -p 8085:8085 --name mall-portal \
--link mysql:db \
--link redis:redis \
--link mongo:mongo \
--link rabbitmq:rabbit \
--link logstash:logstash \
-v /etc/localtime:/etc/localtime \
-v /mydata/app/portal/logs:/var/logs \
-d mall/mall-portal:1.0-SNAPSHOT

Copy

mall-search

docker run -p 8081:8081 --name mall-search \
--link elasticsearch:es \
--link mysql:db \
--link logstash:logstash \
-v /etc/localtime:/etc/localtime \
-v /mydata/app/search/logs:/var/logs \
-d mall/mall-search:1.0-SNAPSHOT

Copy

Other components

Other components such as MySQL and Redis The deployment of will not be repeated , If you want to deploy a full set of partners, you can refer to the deployment documents .

https://www.macrozheng.com/mall/deploy/mall_deploy_docker.html

Visual log analysis

Next, let's experience Kibana Visual log analysis function , With mall Project as an example , It's really powerful ！

Create index matching pattern

• First we need to open Kibana Of Stack management function ;

• by Kibana establish Index matching pattern ;

• You can see that the four log classifications we created before have been in ES Index created in , The suffix is the date when the index was generated ;

• We need an expression to match the corresponding index , First create mall-debug Index matching pattern ;

• And then create mall-error、mall-business and mall-record Index matching pattern ;

• Next, open Find out function , You can see the log information generated in the application .

Log analysis

• Let's talk first mall-debug journal , This kind of log is the most complete log , It can be used for testing environment debugging , When we have multiple services generating logs at the same time , We can filter out the logs of corresponding services through filters ;

• You can also use it Kibana Special query statements KQL To filter ;

• It can also realize fuzzy query , For example, check message Contained in the Pagination Log , The query speed is really fast ;

• adopt mall-error The log can quickly obtain the error information of the application , Pinpoint the problem , For example, put Redis The service was stopped , Here the log is output ;

• adopt mall-business Logs can be viewed com.macro.mall Everything under the bag DEBUG Logs above level , Through this log, we can easily view the output when calling the interface SQL sentence ;

• adopt mall-record The log can easily view the interface request , Include request path 、 Parameters 、 Return results and time-consuming information , Which interface is slow to access at a glance ;

summary

Today I share with you mall The log collection solution in the project and how to pass Kibana To do log analysis , Instead, go to the server directly and use the command line to view the log , It's really much more convenient . and Kibana You can also aggregate logs generated by different services , It also supports full-text search , It's really powerful .

Reference material

About how to customize SpringBoot The log collection mechanism in can be referred to You even go to the server to get logs , Isn't it nice to set up a log collection system ！

If you need to protect the log, you can refer to Someone actually wants to whore my log for nothing , Quickly turn on the safety protection to suppress the shock ！

Project source address

https://github.com/macrozheng/mall