前往小程序,Get更优阅读体验!
立即前往
首页
学习
活动
专区
工具
TVP
发布
社区首页 >专栏 >ELK搭建开源日志系统(window版本)—图文详细

ELK搭建开源日志系统(window版本)—图文详细

作者头像
全栈程序员站长
发布2022-09-27 10:29:44
1.1K0
发布2022-09-27 10:29:44
举报
文章被收录于专栏:全栈程序员必看

大家好,又见面了,我是你们的朋友全栈君

ELK搭建开源日志系统(window版本)—图文详细

日志对于排查错误非常重要,使用linux命令awk sed grep find等命令查询日志非常麻烦,而且很难做数据分析,使用免费开源的ELK可以支撑大规模的日志检索,本文将一步步教怎么快速搭建一个window版本的ELK日志收集系统。

下载elasticsearch、logstash、kibana、filebeat

注意同一系列的版本要一样,防止出现版本不兼容问题,本文使用7.16.0版本,在window系统演示

下载elasticsearch

访问地址为:https://www.elastic.co/cn/downloads/past-releases

点击Donload下载

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-lnxsdUYo-1650982517731)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418221506034.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-lnxsdUYo-1650982517731)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418221506034.png)]

跳转到访问地址为: https://www.elastic.co/cn/downloads/past-releases/elasticsearch-7-16-0

可以选择window或者linux版本,本文下载window版本

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-M1jRDCQE-1650982517734)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222252223.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-M1jRDCQE-1650982517734)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222252223.png)]

下载logstash

点击Donload下载

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-RDykQ2Of-1650982517735)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222022349.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-RDykQ2Of-1650982517735)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222022349.png)]

跳转到访问地址为: https://www.elastic.co/cn/downloads/past-releases/logstash-7-16-0

选择window版本

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-YbuJ55ki-1650982517736)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222156985.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-YbuJ55ki-1650982517736)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222156985.png)]

下载kibana

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-rpJrDCzp-1650982517736)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222344389.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-rpJrDCzp-1650982517736)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222344389.png)]

访问地址为:https://www.elastic.co/cn/downloads/past-releases/kibana-7-16-0

选择window版本

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-MXd9av1V-1650982517737)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222406775.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-MXd9av1V-1650982517737)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222406775.png)]

跳转到访问地址为:https://www.elastic.co/cn/downloads/past-releases/filebeat-7-16-0

下载filebeat

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-3SQr23uj-1650982517737)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222601130.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-3SQr23uj-1650982517737)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222601130.png)]

选择window版本

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-46KKFSYe-1650982517738)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222630758.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-46KKFSYe-1650982517738)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220418222630758.png)]

下载jdk11

由于7.16.0版本需要依赖java jdk11版本,需要将本地java环境切换到jdk11

访问网站: http://www.codebaoku.com/jdk/jdk-oracle-jdk11.html

点击下载

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-FwGL7AIQ-1650982517739)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420200908722.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-FwGL7AIQ-1650982517739)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420200908722.png)]

全部下载完解压

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-onb7yQoC-1650982517739)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420202003124.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-onb7yQoC-1650982517739)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420202003124.png)]

安装jdk11、elasticsearch、kibana、logstash、filebeat

安装jdk11

使用win+X键,并选择Windows终端

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-GY7Bzyl7-1650982517740)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420202133767.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-GY7Bzyl7-1650982517740)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420202133767.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-jSEXSP3J-1650982517740)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420202251028.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-jSEXSP3J-1650982517740)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420202251028.png)]

输入

代码语言:javascript
复制
cd F:\soft\elk
dir	
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-5Cur3xeu-1650982517741)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420202824707.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-5Cur3xeu-1650982517741)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420202824707.png)]

打开window搜索框搜索环境变量,打开编辑系统环境变量

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-kXjAYeAv-1650982517741)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420203326862.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-kXjAYeAv-1650982517741)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420203326862.png)]

点击环境变量

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-PozDjn3n-1650982517742)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420203449479.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-PozDjn3n-1650982517742)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420203449479.png)]

添加JAVA_HOME路径

代码语言:javascript
复制
F:\soft\elk\jdk-11.0.13_windows-x64_bin\jdk-11.0.13
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-UHOzoqff-1650982517742)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420205025647.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-UHOzoqff-1650982517742)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420205025647.png)]

将java执行路径添加到Path变量中,输入

代码语言:javascript
复制
%JAVA_HOME%\bin
%JAVA_HOM%\jre\bin
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-r1YdIZGU-1650982517743)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420203823640.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-r1YdIZGU-1650982517743)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420203823640.png)]

新打开一个shell(一定要重新打开一个新的shell才会加载刚配置过的jdk11环境变量)

并执行命令,可以看到jdk11提示输出,表示jdk11安装成功

代码语言:javascript
复制
java -version
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-k2hr9SWx-1650982517743)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420214822004.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-k2hr9SWx-1650982517743)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420214822004.png)]

启动elasticsearch

启动新的shell,并执行命令

代码语言:javascript
复制
cd F:\soft\elk
.\elasticsearch-7.16.0-windows-x86_64\elasticsearch-7.16.0\bin\elasticsearch.bat

如果本地使用localhost访问,不需要修改配置文件,否则需要修改如下

代码语言:javascript
复制
network.host: 0.0.0.0
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-mudaFWwp-1650982517744)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423214458423.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-mudaFWwp-1650982517744)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423214458423.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-QhT6ahbV-1650982517744)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420204714883.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-QhT6ahbV-1650982517744)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420204714883.png)]

可以看到elasticsearch执行成功

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-yXVfRQmx-1650982517745)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420215030696.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-yXVfRQmx-1650982517745)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420215030696.png)]

启动kibana

启动新的shell,并执行命令

代码语言:javascript
复制
cd F:\soft\elk
.\kibana-7.16.0-windows-x86_64\kibana-7.16.0-windows-x86_64\bin\kibana.bat
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-5LEZYmNQ-1650982517745)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420215355755.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-5LEZYmNQ-1650982517745)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420215355755.png)]

可以看到执行成功

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-8PcUKiDE-1650982517746)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420215454109.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-8PcUKiDE-1650982517746)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420215454109.png)]

访问网站,可以看到启动成功

http://localhost:5601/app/home#/

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-L7KOP3WE-1650982517746)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420215557167.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-L7KOP3WE-1650982517746)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420215557167.png)]

点击Explore on my own

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-AIGFhhA7-1650982517747)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423144541137.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-AIGFhhA7-1650982517747)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423144541137.png)]

启动logstash

在logstash配置文件中,新增文件名log.conf

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-HI3UJ5xK-1650982517747)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420220239744.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-HI3UJ5xK-1650982517747)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420220239744.png)]

内容如下:

输入指定通过5044端口使用Filebeat接收数据。

指定在elasticsearch中创建test的索引,将数据输出到test索引中。

代码语言:javascript
复制
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.
input { 
   
  beats { 
   
    port => 5044
  }
}

output { 
   
  elasticsearch { 
   
    hosts => ["http://localhost:9200"]
    index => "test"
    #user => "elastic"
    #password => "changeme"
  }
}

启动新的shell,并执行命令

代码语言:javascript
复制
cd F:\soft\elk
.\logstash-7.16.0-windows-x86_64\logstash-7.16.0\bin\logstash.bat -f D:\conf\logstash-8.1.0-windows-x86_64\logstash-8.1.0\config\log.conf
https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420220650137.png
https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420220650137.png

可以看到启动成功

image-20220420220729325
image-20220420220729325

启动filebeat

新建日志log测试日志文件夹

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-UtCfe7cj-1650982517748)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420221138864.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-UtCfe7cj-1650982517748)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420221138864.png)]

进入log文件夹,创建data.log文件

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-vyEY1SCK-1650982517749)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420221231158.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-vyEY1SCK-1650982517749)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420221231158.png)]

内容为

代码语言:javascript
复制
[08/Nov/2019:11:40:24 +0800] tc-com.net - - 192.168.12.58 192.168.12.58 192.168.15.135 80 GET 200 /geccess/services/capability/L6JN4255 ?pageIndex=1&pageSize=2000&vehicleType=0 21067 17 totalTime:54ms
[08/Nov/2019:11:40:24 +0800] tc-com.net - - 192.168.12.58 192.168.12.58 192.168.15.135 80 GET 200 /geccess/services/capability/L6JN4255 ?pageIndex=1&pageSize=2000&vehicleType=0 21067 17 totalTime:63ms
[08/Nov/2019:11:40:24 +0800] tc-com.net - - 192.168.12.58 192.168.12.58 192.168.15.135 80 GET 200 /geccess/services/capability/L6JN4255 ?pageIndex=1&pageSize=2000&vehicleType=0 21067 17 totalTime:75ms
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-Rh0XjjNA-1650982517749)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420221403224.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-Rh0XjjNA-1650982517749)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420221403224.png)]

编辑filebeat文件

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-cwtil5RN-1650982517750)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420221433916.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-cwtil5RN-1650982517750)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420221433916.png)]

将enable改成true,同时设置日志路径为

代码语言:javascript
复制
F:\soft\elk\log\*.log
image-20220420223015584
image-20220420223015584

将filebeat.config.modules的enable改成true

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-PHjGM6Ln-1650982517751)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423144213743.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-PHjGM6Ln-1650982517751)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423144213743.png)]

将输出到elasticsearch中使用#注释去掉,并将输出到logstash注释删除掉

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-UaIm5SRp-1650982517751)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420221708300.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-UaIm5SRp-1650982517751)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420221708300.png)]
代码语言:javascript
复制
cd F:\soft\elk
.\filebeat-7.16.0-windows-x86_64\filebeat.exe -e -c F:\soft\elk\filebeat-7.16.0-windows-x86_64\filebeat.yml
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-ZPeFdsyc-1650982517751)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420222240061.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-ZPeFdsyc-1650982517751)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220420222240061.png)]

可以看到filebeat运行成功

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-a1vR2LBy-1650982517752)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423144343293.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-a1vR2LBy-1650982517752)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423144343293.png)]

kibana查询日志

命令查询创建的索引数据

访问网站,并点击左上角

http://localhost:5601/app/home#/

image-20220423144541137
image-20220423144541137

左侧向下滑动,选中management,并点击Dev Tools

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-yx5gzdLw-1650982517753)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423144617902.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-yx5gzdLw-1650982517753)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423144617902.png)]

在Console输入下面命令

代码语言:javascript
复制
GET /_cat/indices?v

在点击绿色执行按钮,可以看到,索引test已经创建

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-9ZTXTByS-1650982517753)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423144938859.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-9ZTXTByS-1650982517753)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423144938859.png)]

输入下面命令,查询索引test的数据,可以看到日志数据已经成功上传

代码语言:javascript
复制
GET test/_search
{ 
   
    "query": { 
   
        "match_all": { 
   }
    }
}
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-y0GYYIvY-1650982517753)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423145332557.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-y0GYYIvY-1650982517753)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423145332557.png)]

通过界面查看和索引日志数据

点击Stack Management

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-7jrL9Ijp-1650982517754)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423145805250.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-7jrL9Ijp-1650982517754)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423145805250.png)]

选择Index Patterns

image-20220423150023952
image-20220423150023952

输入索引名称test,可以看到有匹配的,选择时间字段为@timestamp,点击Create Index pattern

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-ZQxqJs3p-1650982517756)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150226384.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-ZQxqJs3p-1650982517756)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150226384.png)]

看到创建成功

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-6NdIMLsK-1650982517756)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150259353.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-6NdIMLsK-1650982517756)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150259353.png)]

选择Discover

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-wNH6lY3A-1650982517757)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150342241.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-wNH6lY3A-1650982517757)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150342241.png)]

可以看到默认为test索引

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-8kXBFOcK-1650982517757)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150404995.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-8kXBFOcK-1650982517757)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150404995.png)]

选择时间范围大一点

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-jOMCB58K-1650982517757)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150440112.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-jOMCB58K-1650982517757)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150440112.png)]

点击Update

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-zcTLOozG-1650982517758)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150502069.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-zcTLOozG-1650982517758)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150502069.png)]

可以看到数据完全被加载出来

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-sF395OA6-1650982517758)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150517409.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-sF395OA6-1650982517758)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150517409.png)]

通过关键词totalTime搜索,点击Refresh,可以看到下面搜索高量的部分

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-DXEg3AMC-1650982517759)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150630046.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-DXEg3AMC-1650982517759)(https://raw.githubusercontent.com/panguchuangshi/hexo-img/main/img/image-20220423150630046.png)]

总结

可以看到一个简单的日志收集系统搭建成功,我们可以根据这套系统收集日志,并做分析,本文只是针对window版本的介绍,后续会在linux版本搭建一套,步骤基本一致,更多实用搜索功能敬请期待。

发布者:全栈程序员栈长,转载请注明出处:https://javaforall.cn/179082.html原文链接:https://javaforall.cn

本文参与 腾讯云自媒体同步曝光计划,分享自作者个人站点/博客。
如有侵权请联系 cloudcommunity@tencent.com 删除

本文分享自 作者个人站点/博客 前往查看

如有侵权,请联系 cloudcommunity@tencent.com 删除。

本文参与 腾讯云自媒体同步曝光计划  ,欢迎热爱写作的你一起参与!

评论
登录后参与评论
0 条评论
热度
最新
推荐阅读
目录
  • ELK搭建开源日志系统(window版本)—图文详细
    • 下载elasticsearch、logstash、kibana、filebeat
      • 下载elasticsearch
      • 下载logstash
      • 下载kibana
      • 下载filebeat
      • 下载jdk11
    • 安装jdk11、elasticsearch、kibana、logstash、filebeat
      • 安装jdk11
      • 启动elasticsearch
      • 启动kibana
      • 启动logstash
      • 启动filebeat
    • kibana查询日志
      • 命令查询创建的索引数据
      • 通过界面查看和索引日志数据
    • 总结
    相关产品与服务
    Elasticsearch Service
    腾讯云 Elasticsearch Service(ES)是云端全托管海量数据检索分析服务,拥有高性能自研内核,集成X-Pack。ES 支持通过自治索引、存算分离、集群巡检等特性轻松管理集群,也支持免运维、自动弹性、按需使用的 Serverless 模式。使用 ES 您可以高效构建信息检索、日志分析、运维监控等服务,它独特的向量检索还可助您构建基于语义、图像的AI深度应用。
    领券
    问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档