ELK Stack日志分析平台搭建实战：Filebeat采集与Kibana可视化查询配置

小编 • • 网站运维

ELK Stack（Elasticsearch、Logstash、Kibana）是日志分析领域最广泛使用的开源方案。在海量日志场景下，通过Filebeat轻量采集、Logstash管道处理、Elasticsearch存储检索、Kibana可视化查询的完整链路，可以实现从日志采集到告警的全流程自动化。DevOps实践中，日志分析平台的搭建是SRE稳定性工程的基础设施之一。

ELK Stack架构设计与组件版本选型

标准ELK架构由四层组成：采集层使用Filebeat部署在每台应用服务器，轻量转发日志；处理层使用Logstash进行过滤、解析和字段映射；存储层使用Elasticsearch集群提供全文检索；展示层使用Kibana提供Web界面查询和仪表盘。组件版本必须保持一致，避免兼容性问题。

# 版本统一为8.x
# Elasticsearch 8.x 默认开启安全认证，需提前规划证书管理

# 基础架构拓扑
# Filebeat(应用服务器) -> Logstash(处理节点) -> Elasticsearch(集群) -> Kibana(展示)

# 关键配置参数
# Elasticsearch: 堆内存设置为物理内存的50%，不超过32G
# Logstash: 堆内存设置为物理内存的25%
# Filebeat: 单实例资源占用不超过100MB内存

Elasticsearch集群部署与索引模板配置

Elasticsearch是ELK Stack的存储和搜索引擎，集群部署需要合理规划节点角色。主节点（master-eligible）负责集群状态管理，数据节点（data）负责索引和查询，协调节点（coordinating）负责请求路由和结果聚合。CI/CD流水线中的日志数据通常按天创建索引，通过索引模板统一配置分片数和映射规则。

# elasticsearch.yml - 数据节点配置
cluster.name: elk-prod
node.name: data-node-1
node.roles: [data]
network.host: 0.0.0.0
discovery.seed_hosts: ["10.0.1.10", "10.0.1.11", "10.0.1.12"]
cluster.initial_master_nodes: ["master-1", "master-2", "master-3"]
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true

# 索引模板：日志数据专用
PUT _index_template/app-logs
{
  "index_patterns": ["app-logs-*"],
  "template": {
    "settings": {
      "number_of_shards": 3,
      "number_of_replicas": 1,
      "refresh_interval": "30s",
      "index.lifecycle.name": "logs-retention"
    },
    "mappings": {
      "properties": {
        "@timestamp": {"type": "date"},
        "level": {"type": "keyword"},
        "service": {"type": "keyword"},
        "host": {"type": "keyword"},
        "message": {"type": "text", "analyzer": "ik_max_word"},
        "trace_id": {"type": "keyword"},
        "duration_ms": {"type": "long"}
      }
    }
  }
}

# ILM策略：日志保留30天自动删除
PUT _ilm/policy/logs-retention
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "50gb",
            "max_age": "1d"
          }
        }
      },
      "delete": {
        "min_age": "30d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

Filebeat轻量采集器配置与多源日志收集

Filebeat是ELK体系中替代Logstash作为采集端的轻量组件，资源占用极低，适合在每台应用服务器部署。Filebeat通过Input模块采集不同来源的日志，通过Processor进行本地预处理，再通过Output发送到Logstash或直接发送到Elasticsearch。

# filebeat.yml
filebeat.inputs:
# Nginx访问日志
- type: filestream
  id: nginx-access
  paths:
    - /var/log/nginx/access.log
  parsers:
    - ndjson:
        target: ""
        overwrite_keys: true
  fields:
    log_type: nginx-access
  fields_under_root: true

# 应用JSON格式日志
- type: filestream
  id: app-logs
  paths:
    - /opt/webapp/logs/*.log
  parsers:
    - ndjson:
        target: ""
        add_error_key: true
  fields:
    log_type: application
  fields_under_root: true

# 系统日志
- type: filestream
  id: syslog
  paths:
    - /var/log/syslog
    - /var/log/messages
  fields:
    log_type: system

# 处理器：解析和增强
processors:
  - add_host_metadata:
      when.not.contains.host: hostname
  - add_fields:
      target: ''
      fields:
        env: production
        cluster: elk-prod
  - timestamp:
      field: "@timestamp"
      layouts:
        - '2006-01-02T15:04:05Z07:00'
      test:
        - '2026-08-25T10:30:00Z'
  - drop_fields:
      fields: ["agent", "ecs", "input"]
      ignore_missing: true

# 输出到Logstash
output.logstash:
  hosts: ["10.0.1.20:5044"]
  index: filebeat
  ssl.certificate_authorities: ["/etc/filebeat/ca.crt"]

# 监控
monitoring.enabled: true
monitoring.elasticsearch.hosts: ["https://10.0.1.10:9200"]

Logstash管道过滤规则与字段映射

Logstash接收Filebeat发送的数据后，通过filter插件进行解析、转换和增强。Grok是Logstash最常用的日志解析插件，通过预定义模式将非结构化日志解析为结构化字段。故障应急响应场景中，结构化的日志字段是实现快速检索和聚合分析的前提。

# logstash.conf
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/logstash/certs/logstash.crt"
    ssl_key => "/etc/logstash/certs/logstash.key"
  }
}

filter {
  if [log_type] == "nginx-access" {
    grok {
      match => {
        "message" => '%{IP:client_ip} - %{DATA:user} \[%{HTTPDATE:timestamp}\] "%{WORD:method} %{URIPATH:path} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER:bytes} "%{DATA:referrer}" "%{DATA:agent}" rt=%{NUMBER:response_time}'
      }
    }
    mutate {
      convert => {
        "status" => "integer"
        "bytes" => "integer"
        "response_time" => "float"
      }
    }
  }

  if [log_type] == "application" {
    json {
      source => "message"
      target => "app"
    }
    mutate {
      add_field => {
        "service" => "%{[app][service]}"
        "level" => "%{[app][level]}"
        "trace_id" => "%{[app][trace_id]}"
      }
    }
  }

  # 通用处理
  date {
    match => ["timestamp", "ISO8601", "yyyy-MM-dd HH:mm:ss"]
    target => "@timestamp"
  }

  mutate {
    remove_field => ["message", "[app][message]"]
  }
}

output {
  elasticsearch {
    hosts => ["https://10.0.1.10:9200"]
    user => "elastic"
    password => "${ES_PASSWORD}"
    index => "%{[log_type]}-%{+yyyy.MM.dd}"
    template => "/etc/logstash/templates/app-logs.json"
  }
}

Kibana可视化查询与仪表盘配置

Kibana提供日志查询、聚合分析和可视化仪表盘功能。监控告警体系中，Kibana的Discover页面支持Lucene和KQL两种查询语法，Dashboard支持柱状图、饼图、时间序列等多种图表类型。

# Kibana查询语法示例（KQL）

# 按服务名和日志级别查询
service: "webapp" and level: "ERROR"

# 按时间范围和trace_id查询
@timestamp >= "2026-08-25T09:00:00Z" and trace_id: "abc123"

# 模糊匹配消息内容
message: *timeout* or message: *connection refused*

# 聚合查询：统计各服务错误率
service: * and level: "ERROR" 
| group by service
| count

# 仪表盘配置
# 1. 时间序列图：每分钟日志量趋势
# x轴: @timestamp (date histogram, interval: 1m)
# y轴: count, split series by log_type

# 2. 服务错误率饼图
# filter: level: "ERROR"
# bucket: service.keyword (terms aggregation)
# metric: count

# 3. 响应时间百分位图
# x轴: @timestamp (date histogram)
# y轴: response_time (percentile ranks: 50, 95, 99)

# Kibana告警规则
# 当某服务5分钟内ERROR日志超过100条时触发告警
PUT _watcher/watch/error-spike
{
  "trigger": {"schedule": {"interval": "5m"}},
  "input": {
    "search": {
      "request": {
        "indices": ["app-logs-*"],
        "body": {
          "query": {
            "bool": {
              "filter": [
                {"term": {"level": "ERROR"}},
                {"range": {"@timestamp": {"gte": "now-5m"}}}
              ]
            }
          },
          "aggs": {"by_service": {"terms": {"field": "service"}}}
        }
      }
    }
  },
  "condition": {
    "compare": {"ctx.payload.hits.total": {"gt": 100}}
  },
  "actions": {
    "notify": {
      "webhook": {
        "method": "POST",
        "url": "https://alerts.internal/api/notify",
        "body": "{{ctx.payload.hits.total}} errors in 5 minutes"
      }
    }
  }
}

ELK Stack在混沌工程实践中也扮演重要角色。通过结构化日志分析，可以快速定位故障注入后的异常行为模式，验证系统的容错能力。Filebeat的轻量特性使其可以在不应用服务器资源的前提下实现全量日志采集，配合Elasticsearch的ILM策略自动管理日志生命周期，避免存储膨胀。整个链路从采集到可视化完全自动化，是DevOps实践中日志基础设施的标准配置。

原创文章，作者：小编，如若转载，请注明出处：https://www.yunthe.com/elkstack-ri-zhi-fen-xi-ping-tai-da-jian-shi-zhan-filebeat/

赞 (0)
小编小编
0
上一篇 1天前
下一篇 1天前

相关推荐