elasticsearch - How do I monitor elasticsearch's logs using Graylog?

Question

I need to monitor elasticsearch's logs by using graylog. I setted up graylog but I am confused as to use which input type to monitor from log files of elasticserach.

Answer 1

看看这些说明：https ://gist.github.com/joschi/e5d50048ddbcef038df9c4527b653ea9

• 下载并解压 Elasticsearch

• 将logstash-gelf和json-simple下载到./libElasticsearch目录下：

  cd /path/to/elasticsearch/
  pushd ./lib
  wget http://central.maven.org/maven2/com/googlecode/json-simple/json-simple/1.1.1/json-simple-1.1.1.jar \
    http://central.maven.org/maven2/biz/paluch/logging/logstash-gelf/1.10.0/logstash-gelf-1.10.0.jar
  popd
  

• 将 logstash-gelf appender 添加到config/logging.yml：

  # you can override this using by setting a system property, for example -Des.logger.level=DEBUG
  es.logger.level: INFO
  rootLogger: ${es.logger.level}, console, file, gelf
  logger:
    # [...]
  appender:
    # [...]
    gelf:
      type: biz.paluch.logging.gelf.log4j.GelfLogAppender
      Host: "udp:127.0.0.1"
      Port: 12201
      Facility: elasticsearch
      ExtractStackTrace: true
      FilterStackTrace: true
      IncludeFullMdc: true
  

• 启动弹性搜索

评论

如果 Graylog 未运行或配置的 GELF 主机不可访问，您将在启动时看到以下错误消息。它们可以被忽略并且特定于 GELF 附加程序（其他人可能会抛出其他异常或根本不抛出异常）：

[2016-06-22 16:31:46,451][INFO ][node                     ] [Jonothon Starsmore] version[2.3.2], pid[30390], build[b9e4a6a/2016-04-21T16:03:47Z]
[2016-06-22 16:31:46,462][INFO ][node                     ] [Jonothon Starsmore] initializing ...
log4j:ERROR null
java.io.IOException: Cannot send data to /127.0.0.1:12201
    at biz.paluch.logging.gelf.intern.sender.GelfUDPSender.sendDatagrams(GelfUDPSender.java:59)
    at biz.paluch.logging.gelf.intern.sender.GelfUDPSender.sendMessage(GelfUDPSender.java:49)
    at biz.paluch.logging.gelf.log4j.GelfLogAppender.append(GelfLogAppender.java:95)
    at org.apache.log4j.AppenderSkeleton.doAppend(AppenderSkeleton.java:251)
    at org.apache.log4j.helpers.AppenderAttachableImpl.appendLoopOnAppenders(AppenderAttachableImpl.java:66)
    at org.apache.log4j.Category.callAppenders(Category.java:206)
    at org.apache.log4j.Category.forcedLog(Category.java:391)
    at org.apache.log4j.Category.log(Category.java:856)
    at org.elasticsearch.common.logging.log4j.Log4jESLogger.internalInfo(Log4jESLogger.java:120)
    at org.elasticsearch.common.logging.support.AbstractESLogger.info(AbstractESLogger.java:81)
    at org.elasticsearch.node.Node.<init>(Node.java:151)
    at org.elasticsearch.node.Node.<init>(Node.java:140)
    at org.elasticsearch.node.NodeBuilder.build(NodeBuilder.java:143)
    at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:178)
    at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:270)
    at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35)
Caused by: java.net.PortUnreachableException
    at sun.nio.ch.DatagramDispatcher.write0(Native Method)
    at sun.nio.ch.DatagramDispatcher.write(DatagramDispatcher.java:51)
    at sun.nio.ch.IOUtil.writeFromNativeBuffer(IOUtil.java:93)
    at sun.nio.ch.IOUtil.write(IOUtil.java:65)
    at sun.nio.ch.DatagramChannelImpl.write(DatagramChannelImpl.java:605)
    at biz.paluch.logging.gelf.intern.sender.GelfUDPSender.sendDatagrams(GelfUDPSender.java:56)
    ... 15 more