Elasticsearch Service
有奖捉虫：办公协同&微信生态&物联网文档专题 HOT
文档中心 > Elasticsearch Service > Logstash 指南 > 查询日志

查询日志

最近更新时间：2023-05-24 16:00:29

我的收藏

本页目录：

本文为您介绍 Logstash 实例运行日志的使用说明。用户可以通过实例的运行日志，可以了解实例的运行状况、定位问题、辅助实例的应用开发和运维。

查询实例日志

1. 登录 Elasticsearch Service 控制台，在左侧导航栏单击 Logstash 管理，进入 Logstash 管理列表页。
2. 选择要查询实例日志的实例，单击 ID/名称，进入实例基本信息页。
3. 在实例基本信息页，切换到日志页签，即可查看实例的运行日志。
日志类型：主日志、慢日志和 GC 日志，日志内容包括日志时间、日志级别，以及具体信息等。
默认提供实例7天内的运行日志，按时间倒序展示，用户可以按时间和关键字进行查询。
4. 在日志页面的搜索框，可以按照时间范围和关键字查询相关日志，关键字查询语法同 lucene 查询语法一致。
输入关键词查询，例如：“logstash”。
指定字段设置关键词，例如：message:logstash 。
多个条件组合：level:INFO AND ip:x.x.x.x，可以查询相关日志。




日志说明

主日志

展示实例运行产生日志的时间、级别、信息等，有 INFO、WARN、DEBUG 等不同级别。
[2021-04-20T16:49:21,909][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"/usr/local/service/logstash/data/queue"}
[2021-04-20T16:49:21,927][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.dead_letter_queue", :path=>"/usr/local/service/logstash/data/dead_letter_queue"}
[2021-04-20T16:49:22,316][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.8.13"}
[2021-04-20T16:49:22,342][INFO ][logstash.agent           ] No persistent UUID file found. Generating new UUID {:uuid=>"2233f3e8-369c-4252-9322-8e2ee8b3371c", :path=>"/usr/local/service/logstash/data/uuid"}
[2021-04-20T16:49:29,260][INFO ][logstash.pipeline        ] Starting pipeline {:pipeline_id=>"ls-ngc79myh-temp-pipeline", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2021-04-20T16:49:29,367][INFO ][logstash.pipeline        ] Pipeline started successfully {:pipeline_id=>"ls-ngc79myh-temp-pipeline", :thread=>"#<Thread:0x4f68fc17 run>"}
[2021-04-20T16:49:29,430][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:"ls-ngc79myh-temp-pipeline"], :non_running_pipelines=>[]}
[2021-04-20T16:49:29,628][INFO ][logstash.pipeline        ] Pipeline has terminated {:pipeline_id=>"ls-ngc79myh-temp-pipeline", :thread=>"#<Thread:0x4f68fc17 run>"}
[2021-04-20T16:49:29,730][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}

慢日志

通过慢日志可以查看哪些 event 在管道传输过程中耗时比较久。默认情况下，慢日志不开启。开启 Logstash 实例的慢日志，可通过在控制台中修改 YML 配置完成。YML 配置修改完成后，单击修改，在弹出页面单击保存，确认可以重启实例后，即可开启慢日志。



GC 日志

Logstash 默认开启 GC 日志，典型的 GC 日志内容如下：
Java HotSpot(TM) 64-Bit Server VM (25.181-b13) for linux-amd64 JRE (1.8.0_181-b13), built on Jul  7 2018 00:56:38 by "java_re" with gcc 4.3.0 20080428 (Red Hat 4.3.0-8)
Memory: 4k page, physical 16092620k(14287236k free), swap 0k(0k free)
CommandLine flags: -XX:CMSInitiatingOccupancyFraction=75 -XX:ErrorFile=/usr/local/service/logstash/temp/hs_err_pid%p.log -XX:GCLogFileSize=67108864 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/usr/local/service/logstash/temp -XX:InitialHeapSize=12884901888 -XX:MaxHeapSize=12884901888 -XX:MaxNewSize=348966912 -XX:MaxTenuringThreshold=6 -XX:NewSize=348966912 -XX:NumberOfGCLogFiles=32 -XX:OldPLABSize=16 -XX:OldSize=697933824 -XX:+PrintGC -XX:+PrintGCApplicationStoppedTime -XX:+PrintGCDateStamps -XX:+PrintGCDetails -XX:+PrintGCTimeStamps -XX:+PrintTenuringDistribution -XX:+UseCMSInitiatingOccupancyOnly -XX:+UseCompressedClassPointers -XX:+UseCompressedOops -XX:+UseConcMarkSweepGC -XX:+UseGCLogFileRotation -XX:+UseParNewGC 
2021-04-20T16:49:04.939+0800: 0.361: Total time for which application threads were stopped: 0.0001580 seconds, Stopping threads took: 0.0000350 seconds
2021-04-20T16:49:04.954+0800: 0.376: Total time for which application threads were stopped: 0.0000788 seconds, Stopping threads took: 0.0000196 seconds
2021-04-20T16:49:05.005+0800: 0.427: Total time for which application threads were stopped: 0.0000990 seconds, Stopping threads took: 0.0000332 seconds
2021-04-20T16:49:05.408+0800: 0.829: Total time for which application threads were stopped: 0.0002044 seconds, Stopping threads took: 0.0000273 seconds
2021-04-20T16:49:05.787+0800: 1.209: Total time for which application threads were stopped: 0.0002146 seconds, Stopping threads took: 0.0000266 seconds
2021-04-20T16:49:06.262+0800: 1.684: Total time for which application threads were stopped: 0.0001038 seconds, Stopping threads took: 0.0000253 seconds
2021-04-20T16:49:06.285+0800: 1.707: Total time for which application threads were stopped: 0.0000858 seconds, Stopping threads took: 0.0000486 seconds

中国站