Elastic:监控 Beats 及 APM Server

在之前的文章 “Elastic:监控 Elasticsearch 及 Kibana” 中,我已经描述了如何监控 Elasticsearch 及 Kibana。在今天的文章中,我将来详述如何来监控 Beats, Logstash 以及 APM。它们的原理基本相同,都是使用 Metricbeat 来对它们进行监控。如果你对测试的环境和配置不是很熟悉的话,请阅读上一篇文章 “Elastic:监控 Elasticsearch 及 Kibana”。

所有 Beats 默认都使用端口 5066 进行监视,因此,如果要监视在同一系统上运行的多个 Beat,则需要为不同的 Beat 设置不同的端口。我们需要对每个 Beat 进行如下的设置:

http.enabled: true
http.port: <端口地址>


监控 Heartbeat

如果你对如何使用 Heartbeat 来对一个网站进行监控的话,你可以参考我之前的文章 “Elastic:使用 Heartbeat 进行 Uptime 监控”。比如我们和容易地配置 Heartbeat 以使得它能监控在 Mac OS 上运行的 Elasticsearch 状态。我们把 Heartbeat 按照于 Mac OS 上,并修改它的配置文件:


  # Directory + glob pattern to search for configuration files
  path: ${path.config}/monitors.d/*.yml
  # If enabled, heartbeat will periodically check the config.monitors path for changes
  reload.enabled: false
  # How often to check for changes
  reload.period: 5s

# Configure monitors inline
- type: http
  # ID used to uniquely identify this monitor in elasticsearch even if the config changes
  id: elasticsearch_on_mac 
  # Human readable display name for this service in Uptime UI and elsewhere
  name: My Monitor
  # List or urls to query
  urls: ["http://localhost:9200"]
  # Configure task schedule
  schedule: '@every 10s'
  # Total test connection and data exchange timeout
  #timeout: 16s
  # Name of corresponding APM service, if Elastic APM is in use for the monitored service.
  #service.name: my-apm-service-name

# ======================= Elasticsearch template setting =======================

  index.number_of_shards: 1
  index.codec: best_compression
  #_source.enabled: false

# ================================== General ===================================

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.

# The tags of the shipper are included in their own field with each
# transaction published.
#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the
# output.
#  env: staging

# =================================== Kibana ===================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  host: "https://ubuntu:5601"

  # Kibana Space ID
  # ID of the Kibana Space into which the dashboards should be loaded. By default,
  # the Default Space will be used.

# =============================== Elastic Cloud ================================

# These settings simplify using Heartbeat with the Elastic Cloud (https://cloud.elastic.co/).

# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
# `setup.kibana.host` options.
# You can find the `cloud.id` in the Elastic Cloud web UI.

# The cloud.auth setting overwrites the `output.elasticsearch.username` and
# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.

# ================================== Outputs ===================================

# Configure what output to use when sending the data collected by the beat.

# ---------------------------- Elasticsearch Output ----------------------------
  # Array of hosts to connect to.
  hosts: [""]

  # Protocol - either `http` (default) or `https`.
  protocol: "https"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elastic"
  password: "password"
  output.elasticsearch.ssl.certificate: "/Users/liuxg/elastic1/metricbeat.crt"
  output.elasticsearch.ssl.key: "/Users/liuxg/elastic1/metricbeat.key"
  ssl.certificate_authorities: [ "/Users/liuxg/elastic1/ca.crt" ]

# ------------------------------ Logstash Output -------------------------------
  # The Logstash hosts
  #hosts: ["localhost:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

# ================================= Processors =================================

  - add_observer_metadata:

在上面,我们对 Mac OS 上的 Elasticsearch 的连接状态进行监控。如果你配置成功的话,你可以使用如下的命令来进行检验:

$ ./heartbeat test config
Config OK
$ ./heartbeat test output | grep OK
  parse url... OK
    parse host... OK
    dns lookup... OK
    dial up... OK
    handshake... OK
    dial up... OK
  talk to server... OK

然后,我们启动 Heartbeat:

./heartbeat -e

如果以前顺利的话,我们可以在 Ubuntu OS 上的 Kibana 上看到:

上面显示 Elasticsearch 的状态信息。那么我改如何来监控 Heartbeat 的运行状态呢?我们可以使用 Metricbeat 来完成。我们可以参考官方文档。打开 heartbeat.yml 文件,并加入如下的两行到文件的最后面:

http.enabled: true
http.port: 5068
monitoring.cluster_uuid: "eDKfUUAhQEabgI_5L9OlcA"

在上面,请注意,我们需要定义 clustering_uuid。这个值是来自于我们被监控的 Mac OS 集群。我们可以在被监控的集群中运行如下的命令来获得这个值:

GET /_cluster/state

如果我们不设置这个值的话,被监控的 Beats 没法关联到一个集群中去显示。我们重新启动  Heartbeat:

./heartbeat -e

我们接着停止 Metricbeat 的运行,并启动 beat 的模块:

./metricbeat modules enable beat-xpack
$ ./metricbeat modules enable beat-xpack
Enabled beat-xpack

我们同时需要修改 Metricbeat 的 modules.d/beat-xpack.ym 文件:


- module: beat
  xpack.enabled: true
  period: 10s
  hosts: [ "http://localhost:5068" ]

在上面,我们把 5068 端口列入到 hosts 字段里。我们重新启动 Metricbeat:

./metricbeat -e

我们回到 Kibana 的监控界面:

我们看到一个 Beats 被监控:


监控 Filebeat

按照上面同样的方法,我们在 filebeat.yml 文件中添加如下的几行:


http.enabled: true
http.port: 5066
monitoring.cluster_uuid: "eDKfUUAhQEabgI_5L9OlcA"

修改完后,启动 Filebeat.

我们也同时修改 Metricbeat 下的 modules.d/beat-xpack.yml 文件:


- module: beat
  xpack.enabled: true
    - stats
    - state
  period: 10s
  hosts: ["http://localhost:5066","http://localhost:5068"]

重新启动 Metricbeat。

回到 Metricbeat 的监控界面,我们可以看到有两个 Beats 被监控:


监控 Metricbeat

如果我们想用 Metricbeat 来监控另外一个 Metricbeat,那么我们需要在被监控的 Metricbeat 中进行配置。参考 Elastic 官方文档 ,我们需要修改 metricbeat.yml 文件。在 metricbeat.yml 文件的后面,添加:


http.enabled: true
http.port: 5067
monitoring.cluster_uuid: "eDKfUUAhQEabgI_5L9OlcA"

并同时修改监控的 Metricbeat 的 modules.d/beat-xpack.yml 文件:


- module: beat
  xpack.enabled: true
    - stats
    - state
  period: 10s
  hosts: ["http://localhost:5066", "http://localhost:5067", http://localhost:5068"]

重新运行我们的监控 Metricbeat,并在监控画面进行查看:

这次,我们可以看到三个被监控的 Beats。


监控 APM Server

从某种程度上讲 AMP Server 其实就是另外一种 Beat。对于它的监控和 Beats 完全是一样的。我们首先打开 apm-server.yml 文件,并添加如下的行:


http.enabled: true
http.port: 5069

在监控 Metricbeat 中我们添加对这个端口的监控:


- module: beat
  xpack.enabled: true
    - stats
    - state
  period: 10s
  hosts: ["http://localhost:5066", "http://localhost:5067", "http://localhost:5068", "http://localhost:5069"]

在上面,我们添加了对 5069 这个端口的监控。重新运行 Metricbeat,我们可以看到如下的画面:

 如果你对监控 Logstash 感兴趣的话,请阅读文章 “Logstash:使用 Metricbeat 监控 Logstash”。

已标记关键词 清除标记