# 一、安装CAdvisor
为了能够获取到Docker容器的运行状态，用户可以通过Docker的stats命令获取到当前主机上运行容器的统计信息，可以查看容器的CPU利用率、内存使用量、网络IO总量以及磁盘IO总量等信息。


写一个docker-compose.yml文件
```yml
version: '3.8'

services:
  cadvisor:
    image: mirrorgooglecontainers/cadvisor:latest  # Docker Hub 上的替代镜像，国内可访问
    container_name: cadvisor
    restart: always
    network_mode: host
    privileged: true
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    ports:
      - "8080:8080"
```

修改普罗米修斯文件
```yml
# 全局配置
global:
  # 数据抓取间隔（默认1分钟）
  scrape_interval: 15s
  # 告警规则评估频率（建议与抓取间隔一致）
  evaluation_interval: 15s
  # 抓取超时时间（默认10秒）

# 告警配置
alerting:
  alertmanagers:
    - static_configs:
        - targets:
          # 启用Alertmanager时需配置实际地址
          # - alertmanager:9093

# 规则文件配置
rule_files:
  # 告警规则文件路径（支持通配符）
  # - 'alert_rules/*.rules'
  # 记录规则文件路径
  # - 'recording_rules/*.rules'

# 监控目标配置
#监控linux
scrape_configs:
  - job_name: "prometheus-server"
    file_sd_configs:
      - files:
          - /server/prometheus/node_exporter.yml
        refresh_interval: 5s


#监控nginx
  - job_name: nginx
    static_configs:
      - targets: ['192.168.201.104:9113']
        # 自定义标签（用于维度筛选）
        labels:
          name: "nginx"
      
#监控k8s
  - job_name: K8S
    static_configs:
      - targets: ['192.168.201.100:31666']
        # 自定义标签（用于维度筛选）
        labels:
          name: "k8s"

#监控redis
  - job_name: redis
    static_configs:
      - targets: ['192.168.201.104:9121']
        # 自定义标签（用于维度筛选）
        labels:
          name: "redis"
          
#监控docker
  - job_name: docker
    static_configs:
      - targets: ['192.168.201.104:8080']
        # 自定义标签（用于维度筛选）
        labels:
          name: "docker"
```

![image.png](/static/img/7f232d47a476d900a35e8b6cdbfbb5c3.image.webp)


![image.png](/static/img/4ddabc609b5ef5ff191b2ba27e7de833.image.webp)

# 二、导入模板
9621

![image.png](/static/img/bf10eeda9beeed2007b63c2742465ae7.image.webp)

9.Prometheus监控Docker

# 一、安装和配置redis_exporter
redis_exporter下载地址：https://github.com/oliver006/redis_exporter/releases


```js
# 创建专用用户
sudo useradd -rs /bin/false redis_exporter


# 解压并安装
tar xvf redis_exporter-v1.79.0.linux-amd64.tar.gz
mv redis_exporter-v1.79.0.linux-amd64.tar.gz redis_exporter-v1.79.0 
mv redis_exporter-v1.79.0  /usr/local/bin/
```

创建Systemd服务文件

```js
vi /etc/systemd/system/redis_exporter.service
```
```js
[Unit]
Description=Redis Exporter
Documentation=https://github.com/oliver006/redis_exporter
After=network.target

[Service]
Type=simple
User=redis_exporter
Group=redis_exporter
ExecStart=/usr/local/bin/redis_exporter-v1.79.0/redis_exporter \
  --redis.addr=redis://192.168.201.104:6379 \
  --redis.password=12345678
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target
```

```js
sudo systemctl daemon-reload
sudo systemctl enable --now redis_exporter
sudo systemctl start redis_exporter   #启动
sudo systemctl status redis_exporter  # 验证状态
```
# 二、修改普罗米修斯配置

```yml
# 全局配置
global:
  # 数据抓取间隔（默认1分钟）
  scrape_interval: 15s
  # 告警规则评估频率（建议与抓取间隔一致）
  evaluation_interval: 15s
  # 抓取超时时间（默认10秒）

# 告警配置
alerting:
  alertmanagers:
    - static_configs:
        - targets:
          # 启用Alertmanager时需配置实际地址
          # - alertmanager:9093

# 规则文件配置
rule_files:
  # 告警规则文件路径（支持通配符）
  # - 'alert_rules/*.rules'
  # 记录规则文件路径
  # - 'recording_rules/*.rules'

# 监控目标配置
#监控linux
scrape_configs:
  - job_name: "prometheus-server"
    file_sd_configs:
      - files:
          - /server/prometheus/node_exporter.yml
        refresh_interval: 5s


#监控nginx
  - job_name: nginx
    static_configs:
      - targets: ['192.168.201.104:9113']
        # 自定义标签（用于维度筛选）
        labels:
          name: "nginx"
      
#监控k8s
  - job_name: K8S
    static_configs:
      - targets: ['192.168.201.100:31666']
        # 自定义标签（用于维度筛选）
        labels:
          name: "k8s"

#监控redis
  - job_name: redis
    static_configs:
      - targets: ['192.168.201.104:9121']
        # 自定义标签（用于维度筛选）
        labels:
          name: "redis"

```


![image.png](/static/img/6e3ef11e1803fd5da457039f9aa45bc2.image.webp)

常用的监控指标
```js
redis_up                                    # 服务器是否在线
redis_uptime_in_seconds                     # 运行时长，单位 s
rate(redis_cpu_sys_seconds_total[1m]) + rate(redis_cpu_user_seconds_total[1m])  # 占用 CPU 核数
redis_memory_used_bytes                     # 占用内存量
redis_memory_max_bytes                      # 限制的最大内存，如果没限制则为 0
delta(redis_net_input_bytes_total[1m])      # 网络接收的 bytes
delta(redis_net_output_bytes_total[1m])     # 网络发送的 bytes


redis_connected_clients                     # 客户端连接数
redis_connected_clients / redis_config_maxclients # 连接数使用率
redis_rejected_connections_total            # 拒绝的客户端连接数
redis_connected_slaves                      # slave 连接数
```

导入模板，11835

![image.png](/static/img/649440d3bea0fe2181797cdbc00f385d.image.webp)

8.Prometheus监控Redis


```js

input {
  file {
    path => "/usr/local/nginx/logs/access.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    type => "nginx_access"
  }
}

filter {
  grok {
    match => { 
      "message" => '%{IPORHOST:remote_addr} - %{DATA:remote_user} \[%{HTTPDATE:timestamp}\] "%{WORD:method} %{URIPATH:request_path}(?:\?%{URIPARAM:query_params})? HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER:body_bytes_sent} "%{DATA:http_referer}" "%{DATA:user_agent}"'
    }
  }

  date {
    match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
    target => "@timestamp"
  }
}

output {
  elasticsearch {
    hosts => [
      "192.168.201.112:9200",
      "192.168.201.113:9200",
      "192.168.201.114:9200"
    ]
    index => "nginx-access-%{+YYYY.MM.dd}"
  }
}


```

6.ELK架构采集nginx

# 一、介绍和安装


```js
核心功能：数据收集、转换和传输管道。支持从多种来源（文件、数据库等）提取数据，过滤（如解析JSON、正则匹
配）后发送到Elasticsearch。

特点：功能强大但资源消耗较高，适合复杂的数据处理场景。

相比Logstash，Filebeat占用资源极少，适合部署在边缘节点（如服务器、容器）持续采集日志文件。

专一性：仅负责日志收集和转发（到Logstash或Elasticsearch），不处理数据，避免资源浪费。

场景互补：Filebeat + Logstash组合中，Filebeat负责采集，Logstash负责复杂处理，分工明确提升效率。
```
下载网址：https://artifacts.elastic.co/downloads/logstash/logstash-7.17.29-x86_64.rpm

```js
wget https://artifacts.elastic.co/downloads/logstash/logstash-7.17.29-x86_64.rpm
```

```js
rpm -ivh logstash-7.17.29-x86_64.rpm
```

```js
ln  -sv /usr/share/logstash/bin/logstash  /usr/local/bin/
```
# 二、收集TCP端口日志
配置目录
```js
/etc/logstash
```

```js
vi /etc/logstash/logstash-sample.conf
```
```js
input {
  file {
    path => ["/tmp/*.txt"]  # 监听 /tmp 目录下的 .txt 文件
    start_position => "beginning"  # 从文件开头读取
  }
}

output {
  stdout {}  # 输出到控制台（测试用）
}
```
知道配置启动
```js
logstash -f /etc/logstash/logstash-sample.conf
```

![image.png](/static/img/7832b32a36879835035d7bbd7b380320.image.webp)

# 三、收集TCP端口日志

```js
input {
  tcp {
    port => 8888
    codec => "json"  # 可选：如果接收JSON格式数据
  }
}

output {
  stdout {
    codec => rubydebug  # 更好的格式化输出
  }
}
```
启动后去另一台服务器telnet该服务器端口测试

![image.png](/static/img/52909a85a3cfb1d68491594572abffce.image.webp)

成功收集日志
![image.png](/static/img/de6912db1d0f4a52d97dcd11374a70e2.image.webp)

# 三、收集http协议端口日志

```js
input {
  http {
    port => 8888
  }
}

output {
  stdout {
    codec => rubydebug  # 更好的格式化输出
  }
}
```
测试

```js
curl "http://192.168.201.104:8888?greeting=你好啊"
```

![image.png](/static/img/8edd571194859b7120eba60d2548379b.image.webp)

# 三、发送数据输出到redis环境

```js

input {
  tcp {
    port => 9999
  }
}

output {
  stdout {}
  
  redis {
    host => "192.168.201.104"
    port => 6379
    db => 0
    password => "12345678"
    data_type => "list"
    key => "hello word"
  }
}

```
我往该IP端口发送消息，就会往redis写入数据
![image.png](/static/img/848854c44de8221511db0c4112b02912.image.webp)


![image.png](/static/img/1dd28b1b703b4402fde651cd1fc620b6.image.webp)

# 四、发送数据输出到本地文件

```js
input {
  tcp {
    port => 9999
  }
}

output {
  stdout {}
  
 file {
    path => ["/tmp/1.txt"]  # 监听 /tmp 目录下的 .txt 文件
  }
}
```
发送消息写入该服务器下的路径文件
![image.png](/static/img/5b2138ab4135fa3067d18950466a900f.image.webp)

![image.png](/static/img/71299cac68c2794994dcd442267949ba.image.webp)


# 五、发送数据输出到ES

```js
input {
  tcp {
    port => 9999
  }
}

output {
  stdout {}
  

  elasticsearch {
    hosts => ["192.168.201.112:9200", "192.168.201.113:9200", "192.168.201.114:9200"]
    index => "logstash-%{+YYYY.MM.dd}"
  }
}

```


![image.png](/static/img/a874ae8e7ee48a1faf5ea6133f303bc7.image.webp)


![image.png](/static/img/73b9b05ddfe640293ae7e70ac0704a43.image.webp)

5.logstash

# 一、在Filebeat写好配置文件

```yml
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /usr/local/nginx/logs/access.log*
  tags: ["access"]
  fields:
    name: "access"

- type: log
  enabled: true
  paths:
    -  /usr/local/nginx/logs/error.log*
  tags: ["error"]
  fields:
    name: "error"
    
  fields_under_root: true

output.elasticsearch:
  enabled: true
  hosts: ["http://192.168.201.112:9200", "http://192.168.201.113:9200", "http://192.168.201.114:9200"]
  index: "nginx-elk-%{+yyyy.MM.dd}"
  indices:
    - index: "nginx-elk-access-%{+yyyy.MM.dd}"
      when.contains:
        tags: "access"
    - index: "nginx-elk-error-%{+yyyy.MM.dd}"
      when.contains:
        tags: "error"

# 禁用索引生命周期管理
setup.ilm.enabled: false
# 设置索引模板
setup.template.name: "mysongxuan-elk"
setup.template.pattern: "mysongxuan-elk*"
#设置已有索引模版直接覆盖
setup.template.overwrite: true

#设置索引模版分片
setup.template.settings:
    #设置分片数
    index.number_of_shards: 3
    #设置副本数
    index.number_of_replicas: 0
```
在nginx服务器上启动Filebeat
```js
filebeat -e -c /etc/filebeat/filebeat.yml
```

![image.png](/static/img/610238ba4ef2d5e3ce5e65988ccc39be.image.webp)

然后去索引管理创建好索引模式
![image.png](/static/img/11a99c9e86e975cd9f8ba2dcc2a2d09e.image.webp)
最后查看已经完成配置
![image.png](/static/img/432876178efecccc020a5e1d67a82f15.image.webp)


# 二、这种方式查看，不会把字段分出来

![image.png](/static/img/17c900146c150991c9b791fc9991971e.image.webp)

修改nginx.conf
```js
worker_processes  1;

events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;

    include   songxuan.conf; #配置外置文件

    # 定义JSON格式日志
    log_format json_combined escape=json
    '{'
        '"timestamp":"$time_iso8601",'
        '"remote_addr":"$remote_addr",'
        '"remote_user":"$remote_user",'
        '"request":"$request",'
        '"status": "$status",'
        '"body_bytes_sent":"$body_bytes_sent",'
        '"request_time":"$request_time",'
        '"http_referer":"$http_referer",'
        '"http_user_agent":"$http_user_agent",'
        '"http_x_forwarded_for":"$http_x_forwarded_for"'
    '}';
    # 指定访问日志路径和格式
    access_log /usr/local/nginx/logs/access.log json_combined;
    error_log  /usr/local/nginx/logs/error.log;

}

```
```yml
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /usr/local/nginx/logs/access.log*
  tags: ["access"]
  
  #添加json格式
  json.keys_under_root: true
  json.add_error_key: true
  
  fields:
    name: "access"

- type: log
  enabled: true
  paths:
    -  /usr/local/nginx/logs/error.log*
  tags: ["error"]
  fields:
    name: "error"
    
  fields_under_root: true

output.elasticsearch:
  enabled: true
  hosts: ["http://192.168.201.112:9200", "http://192.168.201.113:9200", "http://192.168.201.114:9200"]
  index: "nginx-elk-%{+yyyy.MM.dd}"
  indices:
    - index: "nginx-elk-access-%{+yyyy.MM.dd}"
      when.contains:
        tags: "access"
    - index: "nginx-elk-error-%{+yyyy.MM.dd}"
      when.contains:
        tags: "error"

# 禁用索引生命周期管理
setup.ilm.enabled: false
# 设置索引模板
setup.template.name: "mysongxuan-elk"
setup.template.pattern: "mysongxuan-elk*"
#设置已有索引模版直接覆盖
setup.template.overwrite: true

#设置索引模版分片
setup.template.settings:
    #设置分片数
    index.number_of_shards: 3
    #设置副本数
    index.number_of_replicas: 0
```

这样配置查看能，能区别更清楚字段

![image.png](/static/img/7cccab639f232d2fc4860573d2934156.image.webp)
