ELK實時分析之php的laravel專案日誌

opsonly發表於2019-01-03

最近因公司專案增多，且環境也越來複雜，開發人員找我檢視錯誤日誌越來越頻繁，心裡便念想到ELK，心之所想，念之所達，快來get一項新技能吧

1、系統架構組成

laravel日誌：日誌源通過filebeat將日誌寫進redis中介軟體

logstsh：logstash通過input將redis資料拿來分析，通過其filter模組分析所需要的語句，然後輸出到elasticsearch 3.elasticsearch 接收logstash傳送過來的資料，並提供了一個分散式多使用者能力的全文搜尋引擎

Kibana是一個優秀的前端日誌展示框架，它可以非常詳細的將日誌轉化為各種圖表，為使用者提供強大的資料視覺化支援。

二、各個服務的ip地址

laravel: 172.18.109.227
redis: 172.18.215.207
elasticsearch: 172.18.215.207
kibana: 172.18.215.207
複製程式碼

三、laravel日誌伺服器配置：

配置filebeat yum原始檔

[elastic-5.x]
name=Elastic repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
複製程式碼

安裝filebeat

yum install filebeat
複製程式碼

配置filebeat配置檔案

...
#寫入源
- input_type: log
  paths:
  - /var/www/html/*/storage/logs/laravel-2018-12-29.log
...
#輸出至redis
output.redis:
  # Array of hosts to connect to.
  hosts: ["172.18.215.207:6379"]
  password: "***********"
  db: 0
  timeout: 5
  key: "php-01"

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"
複製程式碼

四、redis伺服器

安裝redis

yum install redis
複製程式碼

配置redis

...
# bind 192.168.1.100 10.0.0.1
bind 172.18.215.207
# bind 127.0.0.1 ::1
#
...
# are explicitly listed using the "bind" directive.
protected-mode yes

# Accept connections on the specified port, default is 6379 (IANA #815344).
# If port 0 is specified Redis will not listen on a TCP socket.
port 6379

# TCP listen() backlog.
#
# In high requests-per-second environments you need an high backlog in order
# to avoid slow clients connections issues. Note that the Linux kernel
# will silently truncate it to the value of /proc/sys/net/core/somaxconn so
# make sure to raise both the value of somaxconn and tcp_max_syn_backlog
# in order to get the desired effect.
tcp-backlog 511
...
# use a very strong password otherwise it will be very easy to break.
#
requirepass ***********

# Command renaming.
#
# It is possible to change the name of dangerous commands in a shared
# environment. For instance the CONFIG command may be renamed into something
# hard to guess so that it
複製程式碼

五、配置logstash伺服器

配置logstash yum源

[elasticsearch-5.x]
name=Elasticsearch repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
複製程式碼

logstash配置檔案

#
# Where to fetch the pipeline configuration for the main pipeline
#
path.config: /etc/logstash/conf.d
#
# Pipeline configuration string for the main pipeline
#
# config.string:
#
...
path.config: /etc/logstash/conf.d
#
...
http.host: "127.0.0.1"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
# http.port: 9600-9700
#
# ------------ Debugging Settings --------------
#
# Options for log.level:
#   * fatal
#   * error
#   * warn
#   * info (default)
#   * debug
#   * trace
#
# log.level: info
path.logs: /var/log/logstash
#
...


vim /etc/logstash/conf.d/nginx.conf

# 從redis將資料取出
input {
  redis {
    type => "php-01"
    host => "172.18.215.207"
    port => "6379"
    db => "0"
    password => "*************"
    data_type => "list"
    key => "php-01"
  }
}


# 格式化laravel日誌
filter {
   grok {
        match => [ "message","\[%{TIMESTAMP_ISO8601:logtime}\] %{WORD:env}\.(?<level>[A-Z]{4,5})\: %{GREEDYDATA:msg}}" ]
        }
}

output {
        #過濾level為ERROR的日誌
        if [level] == "ERROR" {
         elasticsearch {
              hosts => ["127.0.0.1:9200"]
              index => "laravellog"
              user => "elastic"
              password => "changeme"
            }
        }

}
複製程式碼

laravel的例項日誌為

[2019-01-02 09:58:00] produce.INFO: {"code":200,"message":"成功","data":{"code":"1000","message":"成功"}}
[2019-01-02 10:00:03] produce.INFO: 不能充值的原因賬戶金額不夠
[2019-01-02 10:00:03] produce.INFO: 不能充值的原因賬戶金額不夠
[2019-01-02 10:00:03] produce.INFO: 不能充值的原因賬戶金額不夠
[2019-01-02 10:00:34] produce.ERROR: cannot find user by this audience {"exception":"[object] (JPush\\Exceptions\\APIRequestException(code: 1011): cannot find user by this audience at /var/www/html/enjoyCarTask/vendor/jpush/jpush/src/JPush/Http.php:123)
[stacktrace]
#0 /var/www/html/enjoyCarTask/vendor/jpush/jpush/src/JPush/Http.php(16): JPush\\Http::processResp(Array)
#1 /var/www/html/enjoyCarTask/vendor/jpush/jpush/src/JPush/PushPayload.php(537): JPush\\Http::post(Object(JPush\\Client), 'https://api.jpu...', '{\"platform\":\"al...')
#2 /var/www/html/enjoyCarTask/vendor/ucar/push/Push/Jobs/JPush.php(89): JPush\\PushPayload->send()
#3 [internal function]: Ucar\\Push\\Jobs\\JPush->handle(Object(JPush\\Client))
#4 /var/www/html/enjoyCarTask/vendor/laravel/framework/src/Illuminate/Container/BoundMethod.php(29): call_user_func_array(Array, Array)
#5 /var/www/html/enjoyCarTask/vendor/laravel/framework/src/Illuminate/Container/BoundMethod.php(87): Illuminate\\Container\\BoundMethod::Illuminate\\Container\\{closure}()
#6 /var/www/html/enjoyCarTask/vendor/laravel/framework/src/Illuminate/Container/BoundMethod.php(31): Illuminate\\Container\\BoundMethod::callBoundMethod(Object(Illuminate\\Foundation\\Application), Array, Object(Closure))
#7 /var/www/html/enjoyCarTask/vendor/laravel/framework/src/Illuminate/Container/Container.php(564): Illuminate\\Container\\BoundMethod::call(Object(Illuminate\\Foundation\\Application), Array, Array, NULL)
複製程式碼

注意：我們只想把ERROR的資訊提取出來，所以logstash的配置檔案中把level 為ERROR的篩選了出來

六、配置elasticsearch伺服器

配置elasticsearch yum源

[elasticsearch-5.x]
name=Elasticsearch repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
複製程式碼

安裝elasticsearch

yum install -y elasticsearch
複製程式碼

配置elasticsearch

chown -R elasticsearch:elasticsearch /data/es-data
chown -R elasticsearch:elasticsearch /var/log/elstic


vim /etc/elasticsearch/elasticsearch.yml
#
# Use a descriptive name for the node:
#
node.name: Elstic
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
# 資料路徑
path.data: /data/es-data
#

# Path to log files:
#日誌路徑
path.logs: /var/log/elstic
...
# 監聽地址，設定為127，只保持本機訪問
network.host: 127.0.0.1
#
# Set a custom port for HTTP:
#
# 監聽的埠
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
複製程式碼

七、配置kibana服務

vim /etc/kibana/kibana.ym
# Kibana is served by a back end server. This setting specifies the port to use.
# 監聽的埠
server.port: 5601

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
# 監聽地址，使用內網地址，然後用nginx反代
server.host: "127.0.0.1"

# Enables you to specify a path to mount Kibana at if you are running behind a proxy. This only affects
# the URLs generated by Kibana, your proxy is expected to remove the basePath value before forwarding requests
# to Kibana. This setting cannot end in a slash.
#server.basePath: ""

# The maximum payload size in bytes for incoming server requests.
#server.maxPayloadBytes: 1048576

# The Kibana server's name.  This is used for display purposes.
#server.name: "your-hostname"

# The URL of the Elasticsearch instance to use for all your queries.
elasticsearch.url: "http://localhost:9200"

# When this setting's value is true Kibana uses the hostname specified in the server.host
# setting. When the value of this setting is false, Kibana uses the hostname of the host
# that connects to this Kibana instance.
#elasticsearch.preserveHost: true

# Kibana uses an index in Elasticsearch to store saved searches, visualizations and
# dashboards. Kibana creates a new index if the index doesn't already exist.
#kibana.index: ".kibana"

# The default application to load.
....
複製程式碼

八、使用nginx反代kibana

$ cat /etc/nginx/conf.d/elk.conf
server {
    listen 443 http2 ssl;
    listen [::]:443 http2 ssl;

    server_name *********;

	ssl on;
        ssl_certificate "**************";
        ssl_certificate_key "/usr/local/certificate/************";
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_prefer_server_ciphers on;
    #ssl_dhparam /etc/ssl/certs/dhparam.pem;

    ########################################################################
    # from https://cipherli.st/                                            #
    # and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html #
    ########################################################################
    # Disable preloading HSTS for now.  You can use the commented out header line that includes
    # the "preload" directive if you understand the implications.
    #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;

    ##################################

    # 這裡是反向代理到kibana服務 走http協議
    location / {
       proxy_pass   http://127.0.0.1:5601;
    }
}


#配置80埠重寫443埠
server {
        listen 80;
        server_name *********;
        rewrite ^/(.*)$ https://*********/$1;
}
複製程式碼

九、訪問kibana配置索引

啟動所以服務後再次訪問kibana，檢視效果。

大功告成~，以後可以讓開發自己看錯誤日誌咯

總結：

此次因為伺服器數量有限,(不敢在正式伺服器上亂搞= =)只使用了兩臺伺服器，php的laravel日誌和filebeat服務一臺，作為寫入源，Redis，Elasticsearch、Logstash、Kibana，一臺作為日誌處理伺服器，(如果做多臺的話，監聽地址需要改變)。跑一段時間確認沒問題再上正式。
監聽的地址最好都使用內網地址，防止被攻擊。

喜歡我寫的東西的朋友可以關注一下我的公眾號：Devops部落

ELK實時日誌分析平臺環境部署--完整記錄
2016-09-29
ELK日誌分析系統
2020-11-18
elk 日誌分析系統
2015-06-15
ELK 日誌分析體系
2016-06-01
【ELK】日誌分析系統
2016-06-06
ELK(ElasticSearch, Logstash, Kibana)搭建實時日誌分析平臺
2017-10-20
Elasticsearch
ELK-日誌分析系統
2020-09-23
使用Docker快速部署ELK分析Nginx日誌實踐
2018-08-25
DockerNginx
ELK日誌
2020-11-23
ELK+FileBeat日誌分析系統
2021-07-15
ELK日誌分析系統詳解
2020-11-29
CDN日誌實時分析
2018-07-19
日誌分析平臺ELK之搜尋引擎Elasticsearch叢集
2020-10-01
Elasticsearch
企業級日誌分析系統——ELK
2020-11-19
ELK 日誌分析系統 ----------- 部署ElasticSearch群集
2020-10-29
Elasticsearch
ELK前端日誌分析、監控系統
2016-11-28
前端
Docker安裝ELK並實現JSON格式日誌分析
2019-10-24
DockerJSON
日誌分析平臺ELK之日誌收集器filebeat
2020-10-04
ELK日誌系統之通用應用程式日誌接入方案
2018-09-05
ELK日誌系統之使用Rsyslog快速方便的收集Nginx日誌
2018-08-29
Nginx
【ELK】elastalert 日誌告警
2021-01-22
AST
日誌分析平臺ELK之日誌收集器logstash
2020-10-02
ELK 5.0.1+Filebeat5.0.1實時監控MongoDB日誌並使用正則解析mongodb日誌
2017-02-16
MongoDB
[elk]基於elk的業務日誌格式設計
2019-02-16
Kafka專案實戰－使用者日誌上報實時統計之編碼實踐
2017-11-16
Kafka
Kafka專案實戰－使用者日誌上報實時統計之應用概述
2017-11-17
Kafka
go-kit 微服務日誌分析管理（ELK + Filebeat）
2020-03-16
Go微服務
最新Centos7.6 部署ELK日誌分析系統
2019-07-18
CentOS
微服務下，使用ELK做日誌收集及分析
2019-06-13
微服務
centos7 安裝elk日誌分析系統
2017-12-13
CentOS
ELK日誌分析系統超詳細！！理論+實操講解！！
2020-11-13
Kafka專案實戰－使用者日誌上報實時統計之分析與設計
2015-09-07
Kafka
實時日誌分析系統的基本架構
2017-06-22
架構
PHP建立laravel專案
2018-05-25
PHPLaravel
PHP設定時區，記錄日誌檔案的方法
2013-01-06
PHP
＜Zhuuu_ZZ＞Spark專案之log日誌資料分析處理
2020-11-19
Spark
Linux-ELK日誌收集
2021-07-06
Linux
docker 容器日誌集中 ELK + filebeat
2016-09-27
Docker