Fork me on GitHub
Suzf  Blog

How-to use rsyslog parse log to json format and then store in ES


本文的主要目的是将 Apache 的访问日志转换成 JSON 格式,然后存储到 ES, 供 ELK Stack Platform 进行数据分析与统计。 尽管现在许多发行版本都已经默认安装上了 rsyslog, 但是还是推荐从 rsyslog repositories 获取最新的稳定版本。这样你将从中获益。你将需要下面的软件包:

  • rsyslog-mmnormalize. This gives you mmnormalize, a module that will do the parsing of common Apache logs to JSON
  • rsyslog-elasticsearch, for the Elasticsearch output


  1. 加载所需模块
  2. 将 Apache log 传送到中心日志服务器
  3. 配置主队列缓冲您的消息。 这也是定义工作线程数和批量大小的地方(也可以是 Elasticsearch 块的大小)
  4. 将 Apache log 转换成 JSON
  5. 定义一个模板,您可以在其中指定 JSON 信息的格式。 您可以使用此模板通过Elasticsearch输出将日志发送到 Elasticsearch / Logstash

[Forward] Centralized logging for fun and profit

Originally posted on Centralized logging for fun and profit

Setting up a centralized log server using syslog isn't as hard as many may believe. Whether it's logs from Apache, nginx, email services, or even from your own Python applications having a central log server gives you many benefits:

Benefits to a centralized logs

  • Reduces disk space usage and disk I/O on core servers that should be busy doing something else. This is especially true if you want to log all queries to your database. Doing this on the same disk as your actual database creates a write for every read and an extra write for every write.
  • Removes logs from the server in the event of an intrusion or system failure. By having the logs elsewhere you at least have a chance of finding something useful about what happened.
  • All of your logs are in one place, duh! This makes things like grepping through say Apache error logs across multiple webservers easier than bouncing around between boxes. Any log processing and log rotation can also be centralized which may delay your sysadmin from finally snapping and killing everyone.

[译] How-to Send Rsyslog directly to Elasticsearch

Originally posted on the server as codeRsyslog to Elasticsearch

长时间以来,系统管理部门已经知道,集中日志很重要,无论是故障排除还是出于安全考虑。 在我看来,我不仅要集中日志,还要让它们可以搜索。 (在集中式日志文件上的 grep 不是很强大,但这不是我正在寻找的解决方案。)


... is a distributed, RESTful search and analytics engine capable of solving a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data so you can discover the expected and uncover the unexpected.

它提供的几个基础的功能有:存储/索引/搜索 数据。它是典型 ELK Stack(Elasticsearch, Logstash, and Kibana )的一部分。 作为系统管理员,我认为还需要注意的是,当用作集群时,Elasticsearch是分布式系统。 不应该轻率地添加另一个分布式系统。 作为一个例子,我现在有了生产分布式系统的MySQL Galera,RabbitMQ,Nomad和Elasticsearch。

Structured Logging with Rsyslog and Elasticsearch

Article: Structured Logging with Rsyslog and Elasticsearch Author: Radu Gheorghe

As more and more organizations are starting to use our Performance Monitoring and Search Analytics services, we have more and more logs from various components that make up these applications.  So what do we do?  Do we just keep logging everything to files, rotating them, and grepping them when we need to troubleshoot something?  There must be something better we can do!  And indeed, there is – so much so, that we’ll soon be launching Logsene – a Log Analytics service to complement SPM.  When your applications generate a lot of logs, you’d probably want to make some sense of them by searching and/or statistics. Here’s when structured logging comes in handy, and I would like to share some thoughts and configuration examples of how you could use a popular syslog daemon like rsyslog to handle both structured and unstructured logs. Then I’m going to look at how you can take those logs, format them in JSON, and index them with Elasticsearch – for some fast and easy searching and statistics.  If you are going to Berlin Buzzwords this year and you are into logging, Logstash, ElasticSearch, or Kibana, I’ll be talking about them in my JSON logging with ElasticSearch presentation.

How-to Installation and configuration ELK Stack 5


本文主要讲述的是 ELK Stack 5 的简易安装和配置。 Elasticsearch - 分布式的文档(document)存储引擎。它可以实时存储并检索复杂数据结构。 Kibana - 在 Elasticsearch 中分析和搜索数据信息的 bashboard Filebeat - 为 Elasticsearch 传送日志数据的轻量级的组件(基于  Logstash-Forwarder)。 关于 Elasticsearch 5 的安装 --> How-to Install elasticsearch with RPM on CentOS7