1、分析Elasticsearch查询语句的功能。
1)、首先需要收集Elasticsearch集群的查询语句。
2)、然后分析查询语句的常用语句、响应时长等等指标。
2、分析Elasticsearch查询语句的功能&＃xff0c;使用方案。
1)、应用Packetbeat &＃43; Logstash完成数据收集工作。 2)、使用Kibana &＃43; Elasticsearch完成数据分析工作。
3、分析Elasticsearch查询语句的功能&＃xff0c;流程分析。
1)、Production Cluster(Elasticsearch集群) -> Packetbeat -> Logstash(Monitoring Logstash) -> Elasticsearch(Monitoring cluster) -> kibana(Monitoring kibana)。
2)、Production Cluster&＃xff0c;可以使用Elasticsearch&＃xff0c;地址http://192.168.110.133:9200。kibana&＃xff0c;地址http:192.168.110.133:5601。
3)、Elasticsearch(Monitoring cluster&＃xff0c;用于存储Packetbeat抓取的查询语句。Elasticsearch地址http://192.168.110.133:8200&＃xff0c;可以通过bin/elasticsearch -Ecluster.name&＃61;sniff_search -Ehttp.port&＃61;8200 -Epath.data&＃61;sniff快速启动一个节点。kibana&＃xff0c;地址http:192.168.110.133:8601。快速启动方式&＃xff0c;bin/kibana -e http://192.168.110.133:8200 -p 8601。
注意&＃xff1a;Production与Monitoring不能是一个集群&＃xff0c;否则会进入抓包死循环。
4、关于Logstash的配置方案&＃xff0c;文件名称sniff_search.conf&＃xff0c;如下所示&＃xff1a;
1 input {2 beats { # 在5044端口接收beats的输入3 port &＃61;> 5044 4 }5 }6 filter {7 if "search" in [request]{ # 查询语句的过滤&＃xff0c;如果请求中包含search才进行处理8 grok { # 从request中提取query_body&＃xff0c;即实际的查询语句。9 match &＃61;> { "request" &＃61;> ".*\n\{(?
10 }
11 grok { # 从path中提取index&＃xff0c;即对某个索引的操作。
12 match &＃61;> { "path" &＃61;> "\/(?
13 }
14 if [index] {
15 } else {
16 mutate {
17 add_field &＃61;> { "index" &＃61;> "All" }
18 }
19 }
20
21 mutate {
22 update &＃61;> { "query_body" &＃61;> "{%{query_body}"}}
23 }
24
25 # mutate {
26 # remove_field &＃61;> [ "[http][response][body]" ]
27 # }
28 }
29
30 output {
31 #stdout{codec&＃61;>rubydebug}
32
33 if "search" in [request]{ # 只对查询做存储&＃xff0c;如果存在查询就保存到监控的elasticsearch中。
34 elasticsearch {
35 hosts &＃61;> "192.168.110.133:8200"
36 }
37 }
38 }
关于Packetbeat的配置方案&＃xff0c;文件名称sniff_search.yml&＃xff0c;如下所示&＃xff1a;
1 #################### Packetbeat Configuration Example #########################2 3 # This file is an example configuration file highlighting only the most common4 # options. The packetbeat.full.yml file from the same directory contains all the5 # supported options with more comments. You can use it as a reference.6 #7 # You can find the full configuration reference here:8 # https://www.elastic.co/guide/en/beats/packetbeat/index.html9
10 #&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61; Network device &＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;
11
12 # Select the network interface to sniff the data. On Linux, you can use the
13 # "any" keyword to sniff on all connected interfaces.
14 packetbeat.interfaces.device: any
15
16 packetbeat.protocols.http:
17 # Configure the ports where to listen for HTTP traffic. You can disable
18 # the HTTP protocol by commenting out the list of ports.
19 ports: [9200]
20 send_request: true
21 include_body_for: ["application/json", "x-www-form-urlencoded"]
22
23
24 #&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61; Outputs &＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;
25
26 # Configure what outputs to use when sending the data collected by the beat.
27 # Multiple outputs may be used.
28
29 #-------------------------- Elasticsearch output ------------------------------
30 #output.elasticsearch:
31 # Array of hosts to connect to.
32 # hosts: ["localhost:9200"]
33
34 # Optional protocol and basic auth credentials.
35 #protocol: "https"
36 #username: "elastic"
37 #password: "changeme"
38
39 #output.console:
40 # pretty: true
41
42 output.logstash: # 输出到 logstash中。
43 hosts: ["192.168.110.133:5044"]
44
45
46 #&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61; Logging &＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;&＃61;
47
48 # Sets log level. The default log level is info.
49 # Available log levels are: critical, error, warning, info, debug
50 #logging.level: debug
51
52 # At debug level, you can selectively enable logging only for some components.
53 # To enable all selectors use ["*"]. Examples of other selectors are "beat",
54 # "publish", "service".
55 #logging.selectors: ["*"]
5、首先启动Production Cluster(Elasticsearch业务集群或者节点)&＃xff0c;然后启动kibana&＃xff0c;如下所示&＃xff1a;
1 [elsearch&＃64;slaver1 elasticsearch-6.7.0]$ ./bin/elasticsearch -d2 [elsearch&＃64;slaver1 elasticsearch-6.7.0]$ jps3 2645 Jps4 2582 Elasticsearch5 [elsearch&＃64;slaver1 elasticsearch-6.7.0]$ free -h6 total used free shared buff/cache available7 Mem: 5.3G 1.6G 3.2G 22M 485M 3.5G8 Swap: 0B 0B 0B9 [elsearch&＃64;slaver1 elasticsearch-6.7.0]$ curl http://192.168.110.133:9200/
10 {
11 "name" : "cLqvbUZ",
12 "cluster_name" : "elasticsearch",
13 "cluster_uuid" : "FSGn9ENRTh6Ya5SBPV9bxA",
14 "version" : {
15 "number" : "6.7.0",
16 "build_flavor" : "default",
17 "build_type" : "tar",
18 "build_hash" : "8453f77",
19 "build_date" : "2019-03-21T15:32:29.844721Z",
20 "build_snapshot" : false,
21 "lucene_version" : "7.7.0",
22 "minimum_wire_compatibility_version" : "5.6.0",
23 "minimum_index_compatibility_version" : "5.0.0"
24 },
25 "tagline" : "You Know, for Search"
26 }
27 [elsearch&＃64;slaver1 elasticsearch-6.7.0]$ cd ../kibana-6.7.0-linux-x86_64/
28 [elsearch&＃64;slaver1 kibana-6.7.0-linux-x86_64]$ ls
29 bin built_assets config data LICENSE.txt node node_modules nohup.out NOTICE.txt optimize package.json plugins README.txt src target webpackShims
30 [elsearch&＃64;slaver1 kibana-6.7.0-linux-x86_64]$ nohup ./bin/kibana &
31 [1] 2717
32 [elsearch&＃64;slaver1 kibana-6.7.0-linux-x86_64]$ nohup: 忽略输入并把输出追加到"nohup.out"
33
34 [elsearch&＃64;slaver1 kibana-6.7.0-linux-x86_64]$ fuser -n tcp 5601
然后启动Elasticsearch监控集群或者节点&＃xff0c;Elasticsearch(Monitoring cluster监控集群或者节点)&＃xff0c;用于存储Packetbeat抓取的查询语句。
1)、Elasticsearch地址http://192.168.110.133:8200&＃xff0c;可以通过bin/elasticsearch -Ecluster.name&＃61;sniff_search -Ehttp.port&＃61;8200 -Epath.data&＃61;sniff_search快速启动一个节点。其中修改集群名称、端口号、数据存储位置。访问地址&＃xff1a;http://192.168.110.133:8200/
1 [elsearch&＃64;slaver1 elasticsearch-6.7.0]$ ./bin/elasticsearch -Ecluster.name&＃61;sniff_search -Ehttp.port&＃61;8200 -Epath.data&＃61;sniff_search
2)、kibana&＃xff0c;地址http:192.168.110.133:8601。快速启动方式&＃xff0c;bin/kibana -e http://192.168.110.133:8200 -p 8601。如果访问kibana&＃xff0c;出现Kibana server is not ready yet&＃xff0c;说明还在启动&＃xff0c;不是报错了。访问地址&＃xff1a;http://192.168.110.133:8601/
3)、现在开始启动Logstash和Packetbeat&＃xff0c;首先启动Logstash&＃xff0c;然后启动Packbeat。
1 [elsearch&＃64;slaver1 logstash-6.7.0]$ ./bin/logstash -f config/sniff_search.conf 2 Sending Logstash logs to /home/hadoop/soft/logstash-6.7.0/logs which is now configured via log4j2.properties3 [2021-01-11T17:00:28,768][INFO ][logstash.setting.writabledirectory] Creating directory {:setting&＃61;>"path.queue", :path&＃61;>"/home/hadoop/soft/logstash-6.7.0/data/queue"}4 [2021-01-11T17:00:28,835][INFO ][logstash.setting.writabledirectory] Creating directory {:setting&＃61;>"path.dead_letter_queue", :path&＃61;>"/home/hadoop/soft/logstash-6.7.0/data/dead_letter_queue"}5 [2021-01-11T17:00:30,167][WARN ][logstash.config.source.multilocal] Ignoring the &＃39;pipelines.yml&＃39; file because modules or command line options are specified6 [2021-01-11T17:00:30,218][INFO ][logstash.runner ] Starting Logstash {"logstash.version"&＃61;>"6.7.0"}7 [2021-01-11T17:00:30,295][INFO ][logstash.agent ] No persistent UUID file found. Generating new UUID {:uuid&＃61;>"3e7c3496-04fa-4f22-a768-d5e140a69887", :path&＃61;>"/home/hadoop/soft/logstash-6.7.0/data/uuid"}8 [2021-01-11T17:00:51,925][INFO ][logstash.pipeline ] Starting pipeline {:pipeline_id&＃61;>"main", "pipeline.workers"&＃61;>2, "pipeline.batch.size"&＃61;>125, "pipeline.batch.delay"&＃61;>50}9 [2021-01-11T17:00:53,149][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes&＃61;>{:removed&＃61;>[], :added&＃61;>[http://192.168.110.133:8200/]}}
10 [2021-01-11T17:00:53,628][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url&＃61;>"http://192.168.110.133:8200/"}
11 [2021-01-11T17:00:53,772][INFO ][logstash.outputs.elasticsearch] ES Output version determined {:es_version&＃61;>6}
12 [2021-01-11T17:00:53,778][WARN ][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the &＃96;type&＃96; event field won&＃39;t be used to determine the document _type {:es_version&＃61;>6}
13 [2021-01-11T17:00:53,829][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class&＃61;>"LogStash::Outputs::ElasticSearch", :hosts&＃61;>["//192.168.110.133:8200"]}
14 [2021-01-11T17:00:53,890][INFO ][logstash.outputs.elasticsearch] Using default mapping template
15 [2021-01-11T17:00:54,039][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template&＃61;>{"template"&＃61;>"logstash-*", "version"&＃61;>60001, "settings"&＃61;>{"index.refresh_interval"&＃61;>"5s"}, "mappings"&＃61;>{"_default_"&＃61;>{"dynamic_templates"&＃61;>[{"message_field"&＃61;>{"path_match"&＃61;>"message", "match_mapping_type"&＃61;>"string", "mapping"&＃61;>{"type"&＃61;>"text", "norms"&＃61;>false}}}, {"string_fields"&＃61;>{"match"&＃61;>"*", "match_mapping_type"&＃61;>"string", "mapping"&＃61;>{"type"&＃61;>"text", "norms"&＃61;>false, "fields"&＃61;>{"keyword"&＃61;>{"type"&＃61;>"keyword", "ignore_above"&＃61;>256}}}}}], "properties"&＃61;>{"&＃64;timestamp"&＃61;>{"type"&＃61;>"date"}, "&＃64;version"&＃61;>{"type"&＃61;>"keyword"}, "geoip"&＃61;>{"dynamic"&＃61;>true, "properties"&＃61;>{"ip"&＃61;>{"type"&＃61;>"ip"}, "location"&＃61;>{"type"&＃61;>"geo_point"}, "latitude"&＃61;>{"type"&＃61;>"half_float"}, "longitude"&＃61;>{"type"&＃61;>"half_float"}}}}}}}}
16 [2021-01-11T17:00:54,197][INFO ][logstash.outputs.elasticsearch] Installing elasticsearch template to _template/logstash
17 [2021-01-11T17:00:56,341][INFO ][logstash.inputs.beats ] Beats inputs: Starting input listener {:address&＃61;>"0.0.0.0:5044"}
18 [2021-01-11T17:00:56,437][INFO ][logstash.pipeline ] Pipeline started successfully {:pipeline_id&＃61;>"main", :thread&＃61;>"#
19 [2021-01-11T17:00:56,739][INFO ][org.logstash.beats.Server] Starting server on port: 5044
20 [2021-01-11T17:00:56,918][INFO ][logstash.agent ] Pipelines running {:count&＃61;>1, :running_pipelines&＃61;>[:main], :non_running_pipelines&＃61;>[]}
21 [2021-01-11T17:00:57,772][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port&＃61;>9600}
开始然后启动Packbeat&＃xff0c;如果下面的报错&＃xff0c;将输出到控制台的注释了即可&＃xff0c;这里只向logstash输出&＃xff0c;如下所示&＃xff1a;
1 [elsearch&＃64;slaver1 packetbeat-6.7.0-linux-x86_64]$ sudo ./packetbeat -e -c sniff_search.yml -strict.perms&＃61;false2 Exiting: error unpacking config data: more than one namespace configured accessing &＃39;output&＃39; (source:&＃39;sniff_search.yml&＃39;)3 [elsearch&＃64;slaver1 packetbeat-6.7.0-linux-x86_64]$ vim sniff_search.yml 4 [elsearch&＃64;slaver1 packetbeat-6.7.0-linux-x86_64]$ sudo ./packetbeat -e -c sniff_search.yml -strict.perms&＃61;false5 2021-01-11T17:09:59.624&＃43;0800 INFO instance/beat.go:612 Home path: [/home/hadoop/soft/packetbeat-6.7.0-linux-x86_64] Config path: [/home/hadoop/soft/packetbeat-6.7.0-linux-x86_64] Data path: [/home/hadoop/soft/packetbeat-6.7.0-linux-x86_64/data] Logs path: [/home/hadoop/soft/packetbeat-6.7.0-linux-x86_64/logs]6 2021-01-11T17:09:59.626&＃43;0800 INFO instance/beat.go:619 Beat UUID: eac3176e-b703-4258-8b17-ece52ba6b6b27 2021-01-11T17:09:59.626&＃43;0800 INFO [seccomp] seccomp/seccomp.go:116 Syscall filter successfully installed8 2021-01-11T17:09:59.626&＃43;0800 INFO [beat] instance/beat.go:932 Beat info {"system_info": {"beat": {"path": {"config": "/home/hadoop/soft/packetbeat-6.7.0-linux-x86_64", "data": "/home/hadoop/soft/packetbeat-6.7.0-linux-x86_64/data", "home": "/home/hadoop/soft/packetbeat-6.7.0-linux-x86_64", "logs": "/home/hadoop/soft/packetbeat-6.7.0-linux-x86_64/logs"}, "type": "packetbeat", "uuid": "eac3176e-b703-4258-8b17-ece52ba6b6b2"}}}9 2021-01-11T17:09:59.626&＃43;0800 INFO [beat] instance/beat.go:941 Build info {"system_info": {"build": {"commit": "14ca49c28a6e10b84b4ea8cdebdc46bd2eab3130", "libbeat": "6.7.0", "time": "2019-03-21T14:48:48.000Z", "version": "6.7.0"}}}
10 2021-01-11T17:09:59.626&＃43;0800 INFO [beat] instance/beat.go:944 Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":2,"version":"go1.10.8"}}}
11 2021-01-11T17:09:59.654&＃43;0800 INFO [beat] instance/beat.go:948 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2021-01-11T16:37:31&＃43;08:00","containerized":true,"name":"slaver1","ip":["127.0.0.1/8","::1/128","192.168.110.133/24","fe80::b65d:d33b:d10d:8133/64","192.168.122.1/24"],"kernel_version":"3.10.0-957.el7.x86_64","mac":["00:0c:29:e3:5a:02","52:54:00:f6:a6:99","52:54:00:f6:a6:99"],"os":{"family":"redhat","platform":"centos","name":"CentOS Linux","version":"7 (Core)","major":7,"minor":7,"patch":1908,"codename":"Core"},"timezone":"CST","timezone_offset_sec":28800,"id":"6ac9593fe0bc4b3cabb828e56c00d0ae"}}}
12 2021-01-11T17:09:59.661&＃43;0800 INFO [beat] instance/beat.go:977 Process info {"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"ambient":null}, "cwd": "/home/hadoop/soft/packetbeat-6.7.0-linux-x86_64", "exe": "/home/hadoop/soft/packetbeat-6.7.0-linux-x86_64/packetbeat", "name": "packetbeat", "pid": 4529, "ppid": 4527, "seccomp": {"mode":"filter"}, "start_time": "2021-01-11T17:09:58.920&＃43;0800"}}}
13 2021-01-11T17:09:59.661&＃43;0800 INFO instance/beat.go:280 Setup Beat: packetbeat; Version: 6.7.0
14 2021-01-11T17:09:59.670&＃43;0800 INFO [publisher] pipeline/module.go:110 Beat name: slaver1
15 2021-01-11T17:09:59.670&＃43;0800 INFO procs/procs.go:101 Process watcher disabled
16 2021-01-11T17:09:59.672&＃43;0800 WARN [cfgwarn] protos/protos.go:118 DEPRECATED: dictionary style protocols configuration has been deprecated. Please use list-style protocols configuration. Will be removed in version: 7.0.0
17 2021-01-11T17:09:59.673&＃43;0800 INFO [monitoring] log/log.go:117 Starting metrics logging every 30s
18 2021-01-11T17:09:59.673&＃43;0800 INFO instance/beat.go:402 packetbeat start running.
19 2021-01-11T17:10:02.245&＃43;0800 INFO pipeline/output.go:95 Connecting to backoff(async(tcp://192.168.110.133:5044))
20 2021-01-11T17:10:02.246&＃43;0800 INFO pipeline/output.go:105 Connection to backoff(async(tcp://192.168.110.133:5044)) established
6、此时&＃xff0c;整个流程就已经搞完了&＃xff0c;现在在Elasticsearch业务集群或者节点&＃xff0c;然后在Elasticsearch监控集群或者节点就可以查看相关的信息了。
查看http://192.168.110.133:8601/ 这个Elasticsearch监控集群或者节点&＃xff0c;发现已经有logstash-2021.01.11这个索引了&＃xff0c;可以查看一下这个索引信息。
然后查看管理&＃xff0c;点击索引管理&＃xff0c;可以查看Elasticsearch创建的索引信息&＃xff0c;查看一些具体的配置什么的。
然后可以点击管理&＃xff0c;索引模式&＃xff0c;创建索引模式&＃xff0c;将elasticsearch的索引和kibana进行关联&＃xff0c;让kibana管理elasticsearch的索引。
点击创建索引模式&＃xff0c;起一个索引模式的名称&＃xff0c;如下所示&＃xff1a;
然后配置设置&＃xff0c;这里根据时间进行筛选数据。
创建完毕&＃xff0c;是这样的&＃xff0c;如下所示&＃xff1a;
将elasticsearch的索引和kibana进行关联&＃xff0c;让kibana管理elasticsearch的索引&＃xff0c;然后&＃xff0c;可以在Discover进行查看&＃xff0c;如下所示&＃xff1a;
那么&＃xff0c;现在访问http://192.168.110.133:5601/ 这个Elasticsearch业务集群或者节点&＃xff0c;创建索引&＃xff0c;然后进行查询&＃xff0c;就可以在这个Elasticsearch监控集群或者节点进行查看。
然后&＃xff0c;在这个Elasticsearch监控集群或者节点进行查看&＃xff0c;注意查询时间的选择哦。
7、关于Kibana的Discover功能的使用&＃xff0c;如下所示&＃xff1a;
第一步&＃xff1a;关于Kibana的使用流程&＃xff0c;首先需要创建索引的&＃xff0c;可以在Dev Tools(开发工具)功能菜单&＃xff0c;创建索引。
第二步&＃xff1a;然后在管理功能菜单&＃xff0c;Elasticsearch&＃xff0c;索引管理&＃xff0c;查看创建的索引信息(包含索引配置信息等信息)。
第三步&＃xff1a;然后在管理功能菜单&＃xff0c;Kibana&＃xff0c;索引模式&＃xff0c;创建索引模式&＃xff0c;创建索引模式成功之后&＃xff0c;就可以进行查看了。
第四步&＃xff1a;然后在Discover功能菜单、可视化功能菜单&＃xff0c;进行查看相关功能。特别需要注意&＃xff0c;创建索引模式的时候&＃xff0c;第二步将选定时间作为筛选条件&＃xff0c;如果Discover右上角的日期时间选择不正确&＃xff0c;文档数据是不会正常显示的。
关于&＃xff0c;展示的字段&＃xff0c;可以排序字段的顺序和是否展示此字段&＃xff0c;如下所示&＃xff1a;
可以查看&＃xff0c;每个字段的值占比&＃xff0c;值的内容&＃xff0c;以及表格里面每一行的表形式或者json形式展示。
如何使用新建、保存、打开功能&＃xff0c;可以方便保存查询条件&＃xff0c;方便下次使用&＃xff0c;如下所示&＃xff1a;
8、Kibana的Visualize可视化分析&＃xff0c;虽是拖拉拽&＃xff0c;但是这个会了&＃xff0c;可以观察接口调用超时、统计指标、方便观察等等指标。
点击创建可视化&＃xff0c;选择适合自己的图指标&＃xff0c;这玩意没有的话&＃xff0c;还得自己写&＃xff0c;现在搞成了拖拉拽&＃xff0c;方便了很多&＃xff0c;如下所示&＃xff1a;
创建饼图&＃xff0c;点击饼图&＃xff0c;显示如下所示&＃xff1a;
可以看到&＃xff0c;可以选择&＃xff0c;拆分切片、拆分图表&＃xff0c;如下所示&＃xff1a;
最后&＃xff0c;如何制作一个饼图呢&＃xff0c;如下所示&＃xff1a;
创建折线图&＃xff0c;点击折线图。然后&＃xff0c;点击基于“新搜索”&＃xff0c;选择“索引”。然后添加指标&＃xff0c;如下所示&＃xff1a;
如何删除保存的可视化图&＃xff0c;或者保存的查询条件&＃xff0c;可以选择删除或者导出功能&＃xff0c;如下所示&＃xff1a;
9、如何Kibana的可视化分析已经创建完毕了&＃xff0c;可以做一个仪表盘&＃xff0c;有时候老外的思想不得不佩服&＃xff0c;如下所示&＃xff1a;
然后&＃xff0c;点击添加按钮&＃xff0c;如下所示&＃xff1a;
下面&＃xff0c;将可视化或者已保存的搜索添加到仪表盘&＃xff0c;如下所示&＃xff1a;
最终&＃xff0c;不过&＃xff0c;自己记得保存一下自己添加的仪表盘&＃xff0c;不然下次找不到的哦&＃xff0c;展示效果&＃xff0c;如下所示&＃xff1a;
![[大整数乘法] java代码实现](https://img1.php1.cn/3cd4a/24c6f/9f3/0133bb25da242824.jpeg)
京公网安备 11010802041100号