Question

我们正在使用ELK使用docker setup登录我们的spring应用程序。我已经配置了日志存储来从给定路径（应用程序生成日志的位置）读取日志文件并将其传递给弹性搜索。初始设置工作正常，所有日志立即传递给kibana。但是，随着日志大小的增加（或某种形式的应用程序日志记录发生），应用程序的响应时间呈指数级增长，最终导致应用程序和docker网络中的所有内容崩溃。

Logstash配置文件：

input {
  file {
    type => "java"
    path => ["/logs/application.log"]
  }
filter {

  multiline {   
      pattern => "^%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}.*"
      negate => "true"
      what => "previous"
      periodic_flush => false
    }
  if [message] =~ "\tat" {
    grok {
      match => ["message", "^(\tat)"]
      add_tag => ["stacktrace"]
    }
  }
  grok {
    match => [ "message", 
               "(?<timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME})  %{LOGLEVEL:level} %{NUMBER:pid} --- \[(?<thread>[A-Za-z0-9-]+)\] [A-Za-z0-9.]*\.(?<class>[A-Za-z0-9#_]+)\s*:\s+(?<logmessage>.*)",
               "message",
               "(?<timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME})  %{LOGLEVEL:level} %{NUMBER:pid} --- .+? :\s+(?<logmessage>.*)"
             ]
  }

  #Parsing out timestamps which are in timestamp field thanks to previous grok section
  date {
    match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss.SSS" ]
  }
}
output {
  # Sending properly parsed log events to elasticsearch
  elasticsearch {
    hosts => ["elasticsearch:9200"] // elastic search is the name if the service in docker-compose file for elk
}
}}

Logstash Docker文件：

FROM logstash
ADD config/logstash.conf /tmp/config/logstash.conf 
Volume $HOME/Documents/logs /logs
RUN touch /tmp/config/logstash.conf
EXPOSE 5000
ENTRYPOINT ["logstash", "agent","-v","-f","/tmp/config/logstash.conf"]

码头工作者为ELK撰写：

version: '2'
services:
 elasticsearch:
  image: elasticsearch:2.3.3
  command: elasticsearch -Des.network.host=0.0.0.0
  ports:
    - "9200:9200"
    - "9300:9300"
  networks:
    - elk
 logstash:
  build: image/logstash
  volumes:
    - $HOME/Documents/logs:/logs
  ports:
    - "5000:5000"
  networks:
    - elk
 kibana:
  image: kibana:4.5.1
  ports:
    - "5601:5601"
  networks:
    - elk

networks:
  elk:

注意：我的spring-boot应用程序和elk位于不同的网络上。即使它们位于同一容器上，性能问题仍然存在。

这是一个性能问题，因为日志文件的连续写入/轮询会导致读/写锁定问题吗？

ELK用于使用docker的spring boot应用程序 - 性能问题

0 个答案: