目录
输入和输出集成概述
Docker 输入插件允许您使用 Docker Engine API 从 Docker 容器收集指标,从而增强容器化应用程序的可视性和监控。
此输出插件方便将 Telegraf 收集的指标通过 HTTP 事件收集器直接流式传输到 Splunk 中,从而轻松与 Splunk 强大的分析平台集成。
集成详情
Docker
Telegraf 的 Docker 输入插件从 Docker Engine API 收集有价值的指标,提供对正在运行的容器的洞察。此插件利用官方 Docker 客户端与 Engine API 接口,允许用户监控各种容器状态、资源分配和性能指标。通过按名称和状态过滤容器的选项,以及可自定义的标签和标签,此插件支持灵活地监控不同环境中的容器化应用程序,无论是在本地系统上还是在 Kubernetes 等编排平台中。此外,它通过要求访问 Docker 守护程序的权限来解决安全问题,并强调在容器化环境中部署时的正确配置。
Splunk
使用 Telegraf 可以轻松地从许多不同的来源收集和聚合指标,并将它们发送到 Splunk。利用 HTTP 输出插件和专门的 Splunk 指标序列化器,此配置确保高效地将数据摄取到 Splunk 的指标索引中。HEC 是 Splunk 提供的一种高级机制,旨在通过 HTTP 或 HTTPS 可靠地大规模收集数据,为安全、监控和分析工作负载提供关键功能。Telegraf 与 Splunk HEC 的集成通过利用标准 HTTP 协议、内置身份验证和结构化数据序列化,优化了指标摄取,并实现了即时可操作的见解,从而简化了操作。
配置
Docker
[[inputs.docker]]
## Docker Endpoint
## To use TCP, set endpoint = "tcp://[ip]:[port]"
## To use environment variables (ie, docker-machine), set endpoint = "ENV"
endpoint = "unix:///var/run/docker.sock"
## Set to true to collect Swarm metrics(desired_replicas, running_replicas)
## Note: configure this in one of the manager nodes in a Swarm cluster.
## configuring in multiple Swarm managers results in duplication of metrics.
gather_services = false
## Only collect metrics for these containers. Values will be appended to
## container_name_include.
## Deprecated (1.4.0), use container_name_include
container_names = []
## Set the source tag for the metrics to the container ID hostname, eg first 12 chars
source_tag = false
## Containers to include and exclude. Collect all if empty. Globs accepted.
container_name_include = []
container_name_exclude = []
## Container states to include and exclude. Globs accepted.
## When empty only containers in the "running" state will be captured.
# container_state_include = []
# container_state_exclude = []
## Objects to include for disk usage query
## Allowed values are "container", "image", "volume"
## When empty disk usage is excluded
storage_objects = []
## Timeout for docker list, info, and stats commands
timeout = "5s"
## Whether to report for each container per-device blkio (8:0, 8:1...),
## network (eth0, eth1, ...) and cpu (cpu0, cpu1, ...) stats or not.
## Usage of this setting is discouraged since it will be deprecated in favor of 'perdevice_include'.
## Default value is 'true' for backwards compatibility, please set it to 'false' so that 'perdevice_include' setting
## is honored.
perdevice = true
## Specifies for which classes a per-device metric should be issued
## Possible values are 'cpu' (cpu0, cpu1, ...), 'blkio' (8:0, 8:1, ...) and 'network' (eth0, eth1, ...)
## Please note that this setting has no effect if 'perdevice' is set to 'true'
# perdevice_include = ["cpu"]
## Whether to report for each container total blkio and network stats or not.
## Usage of this setting is discouraged since it will be deprecated in favor of 'total_include'.
## Default value is 'false' for backwards compatibility, please set it to 'true' so that 'total_include' setting
## is honored.
total = false
## Specifies for which classes a total metric should be issued. Total is an aggregated of the 'perdevice' values.
## Possible values are 'cpu', 'blkio' and 'network'
## Total 'cpu' is reported directly by Docker daemon, and 'network' and 'blkio' totals are aggregated by this plugin.
## Please note that this setting has no effect if 'total' is set to 'false'
# total_include = ["cpu", "blkio", "network"]
## docker labels to include and exclude as tags. Globs accepted.
## Note that an empty array for both will include all labels as tags
docker_label_include = []
docker_label_exclude = []
## Which environment variables should we use as a tag
tag_env = ["JAVA_HOME", "HEAP_SIZE"]
## Optional TLS Config
# tls_ca = "/etc/telegraf/ca.pem"
# tls_cert = "/etc/telegraf/cert.pem"
# tls_key = "/etc/telegraf/key.pem"
## Use TLS but skip chain & host verification
# insecure_skip_verify = false
Splunk
[[outputs.http]]
## Splunk HTTP Event Collector endpoint
url = "https://splunk.example.com:8088/services/collector"
## HTTP method to use
method = "POST"
## Splunk authentication token
headers = {"Authorization" = "Splunk YOUR_SPLUNK_HEC_TOKEN"}
## Serializer for formatting metrics specifically for Splunk
data_format = "splunkmetric"
## Optional parameters
# timeout = "5s"
# insecure_skip_verify = false
# tls_ca = "/path/to/ca.pem"
# tls_cert = "/path/to/cert.pem"
# tls_key = "/path/to/key.pem"
输入和输出集成示例
Docker
-
监控容器化应用程序的性能:使用 Docker 输入插件来跟踪在 Docker 容器中运行的应用程序的 CPU、内存、磁盘 I/O 和网络活动。通过收集这些指标,DevOps 团队可以主动管理资源分配、排除性能瓶颈并确保不同环境中的最佳应用程序性能。
-
与 Kubernetes 集成:利用此插件收集由 Kubernetes 编排的 Docker 容器的指标。通过滤除不必要的 Kubernetes 标签并专注于关键指标,团队可以简化其监控解决方案并创建仪表板,以提供对 Kubernetes 集群中运行的微服务的整体健康状况的洞察。
-
容量规划和资源优化:使用 Docker 输入插件收集的指标来执行 Docker 部署的容量规划。分析使用模式有助于识别未充分利用的资源和过度配置的容器,从而根据实际使用趋势指导扩展或缩减的决策。
-
容器异常的自动警报:根据 Docker 插件收集的指标设置警报规则,以通知团队资源使用量异常激增或服务中断。这种主动监控方法有助于保持服务可靠性并优化容器化应用程序的性能。
Splunk
-
实时安全分析:利用此插件将来自各种应用程序的安全相关指标实时流式传输到 Splunk 中。组织可以通过关联跨系统的数据流来即时检测威胁,从而显着缩短检测和响应时间。
-
多云基础设施监控:集成 Telegraf 以将来自多云环境的指标直接整合到 Splunk 中,从而实现全面的可见性和运营情报。这种统一的监控使团队能够快速检测性能问题并简化云资源管理。
-
动态容量规划:部署此插件以将来自容器编排平台(如 Kubernetes)的资源指标持续推送到 Splunk 中。利用 Splunk 的分析功能,团队可以自动化预测性扩展和资源分配,避免资源瓶颈并最大限度地降低成本。
-
自动化事件响应工作流程:将此插件与 Splunk 的警报系统相结合,以创建自动化事件响应工作流程。Telegraf 收集的指标会触发实时警报和自动化修复脚本,从而确保快速解决问题并保持高系统可用性。
反馈
感谢您成为我们社区的一份子!如果您有任何一般性反馈或在这些页面上发现了任何错误,我们欢迎并鼓励您提供意见。请在 InfluxDB 社区 Slack 中提交您的反馈。