Log storage method based on ELK
Technical Field
The invention relates to the technical field of computers, in particular to a log storage method based on ELK.
Background
ELK is an abbreviation for three open source software, representing: elasticsearch, logstash and Kibana, both of which are open source software. The elastiscearch is an open source distributed search engine, provides three functions of collecting, analyzing and storing data, and is characterized in that: distributed, zero configuration, auto discovery, index auto-sharding, index copy mechanism, restful style interface, multiple data sources and auto-search load, etc. The logstack is mainly used as a tool for collecting, analyzing and filtering logs, supports a large number of data acquisition modes, generally works in a c/s architecture, a client end is installed on a host computer needing to collect logs, and a server end is responsible for filtering, modifying and other operations of received node logs on an elastic search. Kibana is also an open source and free tool, and Kibana can provide log analysis friendly web interfaces for Logstash and elastic search, and can help summarize, analyze and search important data logs. ELK is used as a logging system by many companies within the industry.
Most of the solutions currently used in the industry are to output all logs in the call link uniformly into one log index of the elastic search (the index in the elastic search is equivalent to the concept of a table in the database), as shown in fig. 1.
When a user accesses a web, a call chain as in fig. 2 will be generated: web- > service a- > service C- > database, or web- > service a- > service B- > database. Existing solutions of this type typically generate a requestId at the entry of the call, and the call via either the method or the service (via the service in fig. 2) has a log probe that records the current method name, the entry, the exit, the time taken for the call, etc. along with the requestId into the ELK system.
But this approach has the following problems:
the logging call chain will generate a large number of logs (especially in large systems), which results in a limited amount of logs that can be saved, requiring regular cleaning. In a typical system, only three to six months of logs would be kept. There are some important log enterprises that wish to be kept permanently.
When an exception occurs in the call chain, the exception log and the link log are stored under the same index, so that the search of the exception log is not facilitated. It can be seen from fig. 1 that when there is an exception log, it is not immediately known from the current view at which position the exception occurred. In addition, because the link logs are massive, searching for exception logs in the link logs can be relatively slow. In addition, in the java program, some exceptions may not be thrown but try catch (capturing exceptions), as shown in fig. 3, where there is an exception, but the traffic does not want to be thrown, and at this time, the exception log is lost.
Disclosure of Invention
In order to overcome the defects in the prior art, the invention provides an ELK-based log storage method for solving the problems.
The technical scheme adopted for solving the technical problems is as follows: an ELK-based log storage method, comprising:
s1: establishing a call chain log recorder, an abnormal log recorder and an important log recorder;
s2: acquiring a link log by calling a link log recorder, acquiring an abnormal log by an abnormal log recorder, and acquiring an important log by an important log recorder;
s3: the call chain logger, exception logger, and importance logger are made to share requestId, sessionId, user ID, user name, and entry method name.
It should be noted that, in the step S1, a method info (String method, date state time, object result, object targets) is set in the call chain log recorder, where the parameter String method is a String method, the parameter Date state time is a method start time, the parameter Object result is an Object result, and the parameter Object targets is a return result;
acquiring requestId, sessionId, user ID and user name in the link log context by method info (Stringmethod, date state Time, object result, object region) and recording requestId, sessionId, user ID and user name together with parameter String method, parameter Date state Time, parameter Object result and parameter Object region into the link log;
after the call chain log recorder is established, the call chain log recorder is arranged in a web entry log layer, a web exception interception layer, a dubbo call interception layer, a mybatis interception layer and a dubbo service front-end interception layer, and is arranged in a state invisible to a programmer.
Optionally, in the step S1, a method error (Throwable e) or a method error (running message, running able e) is set in the exception logger, where the parameter running able e is a jettisonable exception object e, and the parameter running message is an exception description;
acquiring requestId, sessionId, user ID, user name and entry method in the exception log context by a method error (Throwable e) or a method error (running message), and recording requestId, sessionId, user ID, user name and entry method together with parameter running message and/or parameter running message into the exception log;
after the exception log recorder is established, the exception log recorder is arranged in a web exception interception layer, a dubbo call interception layer, a mybatis interception layer and a dubbo service front interception layer and is set to be in a callable state by a programmer.
Specifically, in the step S1, a method log (String funName, string message) is set in the important logger, where a parameter String funName is a function name and a parameter String message is function information;
acquiring requestId, sessionId, user ID, user name and entry method in the important log context by a method log (StringfunName, stringmessage), and recording requestId, sessionId, user ID, user name and entry method together with parameters StringfunName and parameter stringmessage into the important log;
after the critical log logger is built, a programmer-callable state is set.
Preferably, in the step S1, when a request to enter the web portal log layer is made, the method start time and the parameters of the portal method are recorded first, and when the request is returned, the result record is returned, and then the link log is output by using the call link log recorder.
Optionally, in the step S1, after the request enters the entry method, and when the entry method throws an exception, the request is intercepted by the web exception interception layer, then a method, a method start time and parameters are acquired from the web entry log layer, the exception information is used as a result, the call chain log recorder is used to output an exception log, then the error (Throwable e) method of the exception log recorder is used to output detailed exception information, and finally the detailed exception information is returned to the 500 pages designated by the user.
It should be noted that, in the step S1, parameters of the service method and the parameters of the service method corresponding to the transmission are obtained from an org.apoche.dubbo.rpc.filter interface corresponding to the dubbo call interception layer, and start time is recorded, requestId, sessionId, user ID and user name are obtained from a link log context, or requestId, sessionId, user ID, user name and entry method are obtained from an exception log context, and rpccontext.getcontext (). Setattach (strucment) method provided by a dubbo framework corresponding to the dubbo call interception layer is called, requestId, sessionId, user ID, user name and entry method are recorded to an attachment of a transmission packet, and then the invoke method of the parameters of the service method is called to call remote duo service; when a return result exists, a call chain log recorder is used for outputting a chain log; when the exception is thrown by remote call, the call chain log recorder is used for outputting a link log, then the error (Throwable e) method of the exception log recorder is called for outputting detailed information of the exception as an exception log, and the exception is thrown continuously.
Specifically, in the step S1, an interface method Result invoke (invoke <; when a return result exists, a calling chain log recorder is utilized to output a chain log; when the service call throws the exception, the link log is output by the call link log recorder, the error (Throwable e) method of the exception log recorder is then called to output the detailed information of the exception as the exception log, the exception is thrown continuously, and finally the link log context and/or the exception log context are emptied.
Preferably, in the step S1, an interface method Object interface (Invocation invocation) corresponding to the org.apache.ibatis.plug.interntor interface of the mybatis interception layer is used to obtain a query statement of the database to be executed from the parameter indication as a method, and further the parameter is taken out from the parameter indication, the start time is recorded, and then the procedure of the parameter indication is called to call the database; when a return result exists, a call chain log recorder is used for outputting a chain log; when the query statement of the database executes exception rejection, the link log is output by using the call link log recorder, then the detailed information of the exception is output by using the error (Throwable e) method of the exception log recorder as the exception log, and the exception is continuously rejected.
Optionally, step S4 is further included, and step S4 includes: when the internal web interface is required to be called by using the http, before the http initiates the call, the requestId is acquired from the link log context, the exception log context and/or the important log context, and the value of the requestId is filled into the request header as_requestid.
The invention has the beneficial effects that: in the ELK-based log storage method, the call link log, the abnormal log and the important log are split, so that the inquiry of abnormal time is facilitated, and the important log is stored for a longer time. The call link log, the abnormal log and the important log are respectively stored in three different log recorders, so that the log storage quantity can be improved. The link log, the exception log and the important log are recorded under different indexes and share the requestId, so that the related information can be searched under another index by using the requestId under one index, the provided exception logger records the exception in the try catch, and the link log, the exception log and the important log share the session identifier, the user ID, the user name and the entry method name besides the requestId (the entry method name is particularly important in the important log because a certain log is likely to have passed for a long time, when the link log searching entry is wanted to be called through the requestId, and the abnormal log can be searched through the requestId under one index when the abnormality occurs in the calling chain.
Drawings
FIG. 1 is an index of an elastomer search in the prior art;
FIG. 2 is a flow chart of a user accessing a web in the prior art;
FIG. 3 is a prior art center section of a java program with exceptions but not desirable for ejection;
FIG. 4 is a flow chart of an ELK-based log storage method in one embodiment of the invention;
FIG. 5 is a configuration diagram of three types of loggers and six types of interceptor layers in one embodiment of the invention;
FIG. 6 is a user-specified 500 page in one embodiment of the invention.
Detailed Description
The following describes the embodiments of the present invention further with reference to the drawings. The description of these embodiments is provided to assist understanding of the present invention, but is not intended to limit the present invention. In addition, the technical features of the embodiments of the present invention described below may be combined with each other as long as they do not collide with each other.
The method is suitable for providing interception layers of the spring MVC and the dubbo under a micro-service framework of the spring MVC and the dubbo.
As shown in fig. 1-6, an ELK-based log storage method includes:
s1: establishing a call chain log recorder, an abnormal log recorder and an important log recorder;
s2: acquiring a link log by calling a link log recorder, acquiring an abnormal log by an abnormal log recorder, and acquiring an important log by an important log recorder; the exception in the try catch is also recorded by the exception log recorder
S3: the call chain logger, exception logger, and importance logger are made to share requestId, sessionId, user ID, user name, and entry method name.
In the ELK-based log storage method, the call link log, the abnormal log and the important log are split, so that the inquiry of abnormal time is facilitated, and the important log is stored for a longer time. The call link log, the abnormal log and the important log are respectively stored in three different log recorders, so that the log storage quantity can be improved. The link log, the exception log and the important log are recorded under different indexes and share the requestId, so that the related information can be searched under another index by using the requestId under one index, the provided exception logger records the exception in the try catch, and the link log, the exception log and the important log share the session identifier, the user ID, the user name and the entry method name besides the requestId (the entry method name is particularly important in the important log because a certain log is likely to have passed for a long time, when the link log searching entry is wanted to be called through the requestId, and the abnormal log can be searched through the requestId under one index when the abnormality occurs in the calling chain.
It should be noted that, in the step S1, a method info (String method, date state time, object result, object targets) is set in the call chain log recorder, where the parameter String method is a String method, the parameter Date state time is a method start time, the parameter Object result is an Object result, and the parameter Object targets is a return result;
acquiring requestId, sessionId, user ID and user name in the link log context by method info (Stringmethod, date state Time, object result, object region) and recording requestId, sessionId, user ID and user name together with parameter String method, parameter Date state Time, parameter Object result and parameter Object region into the link log;
after the call chain log recorder is established, the call chain log recorder is arranged in a web entry log layer, a web exception interception layer, a dubbo call interception layer, a mybatis interception layer and a dubbo service front-end interception layer, and is arranged in a state invisible to a programmer. The link log recorded by the called link log recorder is output to the index of userlog of ELK.
Optionally, in the step S1, a method error (Throwable e) or a method error (threadable) is set in the exception logger, where a parameter threadable is an exception object e that can be thrown, and is used to set the exception object e to be thrown, and a parameter threadable is an exception description, and is used to set an exception description for the exception object;
acquiring requestId, sessionId, user ID, user name and entry method in the exception log context by a method error (Throwable e) or a method error (running message), and recording requestId, sessionId, user ID, user name and entry method together with parameter running message and/or parameter running message into the exception log;
after the exception log recorder is established, the exception log recorder is arranged in a web exception interception layer, a dubbo call interception layer, a mybatis interception layer and a dubbo service front interception layer and is set to be in a callable state by a programmer. The exception log recorded by the modulated exception log recorder will be output under the index of the ELK's exception log.
Preferably, in the step S1, a method log (String funName, string message) is set in the important logger, where a parameter String funName is a function name and a parameter String message is function information;
acquiring requestId, sessionId, user ID, user name and entry method in the context of the important log by a method log (String funnname, string message), and recording requestId, sessionId, user ID, user name and entry method together with the parameter String funnname and parameter String message into the important log;
after the critical log logger is built, a programmer-callable state is set. The important log recorded by the important log recorder is output to the ELK under the index of normal operation log.
Specifically, in the step S1, when a request to enter the web portal log layer is made, the method start time and the parameters of the portal method are recorded first, and when the request is returned, the result record is returned, and then the link log is output by using the call link log recorder.
It should be noted that, in the step S1, after the request enters the entry method, and when the entry method throws an exception, the request is intercepted by the web exception interception layer, then the method, the method start time and the parameters are obtained from the web entry log layer, the exception information is used as a result, the call chain log recorder is used to output the exception log, then the error (Throwable e) method of the exception log recorder is used to output the detailed exception information, and finally the detailed exception information is returned to the 500 pages designated by the user. The value of the requestId may be shown in an alternative on page 500, as shown in fig. 6. A web anomaly interception layer is arranged in web engineering, a user can set an error page at the layer, when anomalies are thrown out, the requestId is exposed, and the anomaly source can be conveniently and rapidly located.
Preferably, in the step S1, parameters to be transmitted corresponding to the service method and the service method are obtained from parameter Invoker and parameter invocation in an interface method Result invoke (invoke <; when a return result exists, a call chain log recorder is used for outputting a chain log; when the exception is thrown by remote call, the link log is output by the call link log recorder, the simple information of the exception is taken as a result, the error (Throwable e) method of the exception log recorder is called to output the detailed information of the exception as an exception log, and the exception is thrown continuously.
Optionally, in the step S1, an interface method Result invoke (invoke <; when a return result exists, a calling chain log recorder is utilized to output a chain log; when the service call throws the exception, firstly, a call chain log recorder is used for outputting a link log, at the moment, the simple information of the exception is taken as a result, then, a error (Throwable e) method of the exception log recorder is called for outputting detailed information of the exception as an exception log, the exception is continuously thrown out, and finally, the link log context and/or the exception log context are emptied.
It should be noted that, in the step S1, an interface method Object interface (Invocation invocation) corresponding to the org.apoche.ibatis.plug.interntor interface of the mybatis interception layer is utilized, a query statement of the database to be executed is obtained from the parameter indication as a method, the parameter is also taken out from the parameter indication, the start time is recorded, and then the procedure method for calling the parameter indication calls the database; when a return result exists, a call chain log recorder is used for outputting a chain log; when the query statement of the database executes exception rejection, the link log is output by calling the link log recorder, the simple information that the link log is the exception at the moment is taken as a result, the error (Throwable e) method of the exception log recorder is called to output the detailed information of the exception as the exception log, and the exception is continuously rejected.
The ELK-based log storage method further utilizes a basic information acquisition layer to firstly attempt to acquire a value of a request header "_requestid" from a request header of an HttpServletRequest object, if the request header "_requestid" is acquired, if the request header "_requestid" is not acquired, then attempt to acquire the value of the "_requestid" from a url parameter of the request, if the request header "_requestid" is acquired, and if the request header "_requestid" is acquired, then generate the requestId for the current request, if the request header "_requestid" is not acquired, then acquire sessionId, sesssion information, a user ID and a user name from the HttpServletRequest object, and then store requestId, sessionId, the user ID and the user name into a link log context, an abnormal log context or an important log context. The sessioninformation is directly used by the web portal log layer, and when the request processing returns to the basic information acquisition layer, the log context is cleared.
As shown in fig. 5, six kinds of interception layers are provided, and the six kinds of interception layers only need to be configured, and a programmer is not required to write codes. Their positions are shown in fig. 5. Wherein the mybatis interception layer and the dubbo call interception layer are optional configuration, and are configured only when the engineering needs.
It should be noted that, for the internal http call, the call chain is disconnected, that is, the requestId is lost when the http is requested, so in this embodiment, the ELK-based log storage method further includes step S4, where step S4 includes: when the internal web interface is required to be called by using the http, before the http initiates the call, the requestId is acquired from the link log context, the exception log context and/or the important log context, and the value of the requestId is filled into the request header as_requestid. Thus, when the web receives a request, the basic information acquisition layer acquires the requestId, and when an internal http call is made, the call chain is not disconnected.
The link log context, exception log context, and/or importance log context maintain a jdk provided ThreadLocal object that can save variables among threads currently executing. The variables stored in the link log context, the exception log context and/or the important log context are Map objects for accessing common information required by the log.
Because three kinds of logs (link log, exception log, and importance log) are stored separately by three indexes, in the elastic search, the stored policies can be set by indexes. Thus, the expiration time of index userlog is set short, and the time of index normal operation log is set long, so that the requirements of long storage and important log storage time are met.
The embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. It will be apparent to those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, and yet fall within the scope of the invention.