kibana图形使用(小节8)

kibana 画图功能详解

www.elastic.co/guide/cn/ki…

Kibana支持多重图从展示功能，需要日志是json格式的支持，具体如新：

web1(106)

软件包：access.log.zip

解压

cd /usr/local/src/
unzip access.log.zip

追加

cat access.log >> /var/log/access.log

创建可视化

1. 面积图

2. 饼图

3. 数据表

4. 垂直条形图

5. Markdown

仪表盘

页面共享

1. 固定连接

2. 嵌入代码

安装包：pycharm社区版、安装步骤参考

通过坐标地图统计客户IP所在城市

logstash103

安装包：GeoLite2-City

#上传文件后、解压缩
cd /etc/logstash/
tar xf GeoLite2-City_20191015.tar.gz

修改配置文件

在input{}和outpat{}中间添加了filter{}(15行信息)

vim /etc/logstash/conf.d/redis-to-es.conf
input {
  redis {
    host => "192.168.37.104"
    port => "6379"
    password => "123456"
    key => "syslog-37-106"
    data_type => list
    db => 3
  }

  redis {
    host => "192.168.37.104"
    port => "6379"
    password => "123456"
    key => "syslog-37-107"
    data_type => list
    db => 3
  }

  redis {
    host => "192.168.37.104"
    port => "6379"
    password => "123456"
    key => "nginx-accesslog-37-106"
    data_type => list
    db => 3
  }

  redis {
    host => "192.168.37.104"
    port => "6379"
    password => "123456"
    key => "nginx-accesslog-37-107"
    data_type => list
    db => 3
  }
}

filter {
        if [fields][app] == "nginx-106"  { 
        geoip {
                source => "clientip" 
                target => "geoip"
                #文件路径
                database => "/etc/logstash/GeoLite2-City_20191015/GeoLite2-City.mmdb" 
                add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
                add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
        }
    mutate {
      convert => [ "[geoip][coordinates]", "float"]
	}
 }
}

output {
#系统日志
  if [fields][type] == "syslog-106" {
    elasticsearch {
      hosts => ["http://192.168.37.102:9200"]
      index => "filebeat-syslog-37-106-%{+YYYY.MM.dd}"
  }}

  if [fields][type] == "syslog-107" {
    elasticsearch {
      hosts => ["http://192.168.37.102:9200"]
      index => "filebeat-syslog-37-107-%{+YYYY.MM.dd}"
  }}
#nginx日志
  if [fields][app] == "nginx-106" {
    elasticsearch {
      hosts => ["http://192.168.37.102:9200"]
      index => "logstash-nginx-accesslog-37-106-%{+YYYY.MM.dd}"
  }}

  if [fields][app] == "nginx-107" {
    elasticsearch {
      hosts => ["http://192.168.37.102:9200"]
      index => "logstash-nginx-accesslog-37-107-%{+YYYY.MM.dd}"
  }}
}

停服务

systemctl stop logstash

检查文件是否报错

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/redis-to-es.conf -t

重启服务

systemctl restart logstash

web1(106)

追加日志

cat access.log >> /var/log/access.log

刷新一下刷新前

刷新后

添加到仪表盘