Tail 和 Clickhouse 集成

借助 InfluxData 构建的开源数据连接器 Telegraf,实现强大性能和轻松集成。

info

这不是大规模实时查询的推荐配置。为了实现查询和压缩优化、高速摄取和高可用性,您可能需要考虑 Tail 和 InfluxDB

50 亿 +

Telegraf 下载量

#1

时序数据库
来源:DB Engines

10 亿 +

InfluxDB 下载量

2,800+

贡献者

目录

强大性能,无限扩展

收集、组织和处理海量高速数据。当您将任何数据视为时序数据时,它都更有价值。借助 InfluxDB,排名第一的时序平台旨在通过 Telegraf 进行扩展。

查看入门方法

输入和输出集成概述

Tail Telegraf 插件通过跟踪指定的日志文件来收集指标,实时捕获新的日志条目以进行进一步分析。

Telegraf 的 SQL 插件使用简单的表架构和动态列生成将收集的指标发送到 SQL 数据库。当配置为 ClickHouse 时,它会调整 DSN 格式和类型转换设置,以确保无缝数据集成。

集成详情

Tail

tail 插件旨在持续监控和解析日志文件,使其成为实时日志分析和监控的理想选择。它模仿 Unix tail 命令的功能,允许用户指定文件或模式,并开始读取添加的新行。主要功能包括跟踪日志轮换文件、从文件末尾开始读取以及支持日志消息的各种解析格式。用户可以通过各种配置选项自定义插件,例如指定文件编码、监视文件更新的方法以及处理日志数据的过滤器设置。此插件在日志数据对于监控应用程序性能和诊断问题至关重要的环境中尤其有价值。

Clickhouse

Telegraf 的 SQL 插件旨在通过基于传入指标动态创建表和列,将指标数据写入 SQL 数据库。当配置为 ClickHouse 时,它使用 clickhouse-go v1.5.4 驱动程序,该驱动程序采用独特的 DSN 格式和一组专门的类型转换规则,将 Telegraf 的数据类型直接映射到 ClickHouse 的原生类型。这种方法确保了在高吞吐量环境中的最佳存储和检索性能,使其非常适合实时分析和大规模数据仓库。动态模式创建和精确的类型映射实现了详细的时序数据日志记录,这对于监控现代分布式系统至关重要。

配置

Tail

[[inputs.tail]]
  ## File names or a pattern to tail.
  ## These accept standard unix glob matching rules, but with the addition of
  ## ** as a "super asterisk". ie:
  ##   "/var/log/**.log"  -> recursively find all .log files in /var/log
  ##   "/var/log/*/*.log" -> find all .log files with a parent dir in /var/log
  ##   "/var/log/apache.log" -> just tail the apache log file
  ##   "/var/log/log[!1-2]*  -> tail files without 1-2
  ##   "/var/log/log[^1-2]*  -> identical behavior as above
  ## See https://github.com/gobwas/glob for more examples
  ##
  files = ["/var/mymetrics.out"]

  ## Read file from beginning.
  # from_beginning = false

  ## Whether file is a named pipe
  # pipe = false

  ## Method used to watch for file updates.  Can be either "inotify" or "poll".
  ## inotify is supported on linux, *bsd, and macOS, while Windows requires
  ## using poll. Poll checks for changes every 250ms.
  # watch_method = "inotify"

  ## Maximum lines of the file to process that have not yet be written by the
  ## output.  For best throughput set based on the number of metrics on each
  ## line and the size of the output's metric_batch_size.
  # max_undelivered_lines = 1000

  ## Character encoding to use when interpreting the file contents.  Invalid
  ## characters are replaced using the unicode replacement character.  When set
  ## to the empty string the data is not decoded to text.
  ##   ex: character_encoding = "utf-8"
  ##       character_encoding = "utf-16le"
  ##       character_encoding = "utf-16be"
  ##       character_encoding = ""
  # character_encoding = ""

  ## Data format to consume.
  ## Each data format has its own unique set of configuration options, read
  ## more about them here:
  ## https://github.com/influxdata/telegraf/blob/master/docs/DATA_FORMATS_INPUT.md
  data_format = "influx"

  ## Set the tag that will contain the path of the tailed file. If you don't want this tag, set it to an empty string.
  # path_tag = "path"

  ## Filters to apply to files before generating metrics
  ## "ansi_color" removes ANSI colors
  # filters = []

  ## multiline parser/codec
  ## https://elastic.ac.cn/guide/en/logstash/2.4/plugins-filters-multiline.html
  #[inputs.tail.multiline]
    ## The pattern should be a regexp which matches what you believe to be an indicator that the field is part of an event consisting of multiple lines of log data.
    #pattern = "^\s"

    ## The field's value must be previous or next and indicates the relation to the
    ## multi-line event.
    #match_which_line = "previous"

    ## The invert_match can be true or false (defaults to false).
    ## If true, a message not matching the pattern will constitute a match of the multiline filter and the what will be applied. (vice-versa is also true)
    #invert_match = false

    ## The handling method for quoted text (defaults to 'ignore').
    ## The following methods are available:
    ##   ignore  -- do not consider quotation (default)
    ##   single-quotes -- consider text quoted by single quotes (')
    ##   double-quotes -- consider text quoted by double quotes (")
    ##   backticks     -- consider text quoted by backticks (`)
    ## When handling quotes, escaped quotes (e.g. \") are handled correctly.
    #quotation = "ignore"

    ## The preserve_newline option can be true or false (defaults to false).
    ## If true, the newline character is preserved for multiline elements,
    ## this is useful to preserve message-structure e.g. for logging outputs.
    #preserve_newline = false

    #After the specified timeout, this plugin sends the multiline event even if no new pattern is found to start a new event. The default is 5s.
    #timeout = 5s

Clickhouse

[[outputs.sql]]
  ## Database driver
  ## Valid options include mssql, mysql, pgx, sqlite, snowflake, clickhouse
  driver = "clickhouse"

  ## Data source name
  ## For ClickHouse, the DSN follows the clickhouse-go v1.5.4 format.
  ## Example DSN: "tcp://localhost:9000?debug=true"
  data_source_name = "tcp://localhost:9000?debug=true"

  ## Timestamp column name
  timestamp_column = "timestamp"

  ## Table creation template
  ## Available template variables:
  ##  {TABLE}        - table name as a quoted identifier
  ##  {TABLELITERAL} - table name as a quoted string literal
  ##  {COLUMNS}      - column definitions (list of quoted identifiers and types)
  table_template = "CREATE TABLE {TABLE} ({COLUMNS})"

  ## Table existence check template
  ## Available template variables:
  ##  {TABLE} - table name as a quoted identifier
  table_exists_template = "SELECT 1 FROM {TABLE} LIMIT 1"

  ## Initialization SQL (optional)
  init_sql = ""

  ## Maximum amount of time a connection may be idle. "0s" means connections are never closed due to idle time.
  connection_max_idle_time = "0s"

  ## Maximum amount of time a connection may be reused. "0s" means connections are never closed due to age.
  connection_max_lifetime = "0s"

  ## Maximum number of connections in the idle connection pool. 0 means unlimited.
  connection_max_idle = 2

  ## Maximum number of open connections to the database. 0 means unlimited.
  connection_max_open = 0

  ## Metric type to SQL type conversion for ClickHouse.
  ## The conversion maps Telegraf metric types to ClickHouse native data types.
  [outputs.sql.convert]
    conversion_style = "literal"
    integer          = "Int64"
    text             = "String"
    timestamp        = "DateTime"
    defaultvalue     = "String"
    unsigned         = "UInt64"
    bool             = "UInt8"
    real             = "Float64"

输入和输出集成示例

Tail

  1. 实时服务器健康状况监控:实施 Tail 插件以实时解析 Web 服务器访问日志,从而即时了解用户活动、错误率和性能指标。通过可视化此日志数据,运营团队可以快速识别并响应流量或错误高峰,从而提高系统可靠性和用户体验。

  2. 集中式日志管理:利用 Tail 插件聚合分布式系统中多个来源的日志。通过配置每个服务以通过 Tail 插件将其日志发送到集中位置,团队可以简化日志分析,并确保可以从单个界面访问所有相关数据,从而简化故障排除流程。

  3. 安全事件检测:使用此插件监控身份验证日志中未经授权的访问尝试或可疑活动。通过在某些日志消息上设置警报,团队可以利用此插件来增强安全态势并及时响应潜在的安全威胁,从而降低违规风险并提高整体系统完整性。

  4. 动态应用程序性能洞察:与分析工具集成以创建实时仪表板,该仪表板显示基于日志数据的应用程序性能指标。此设置不仅可以帮助开发人员诊断瓶颈和效率低下问题,还可以进行主动性能调优和资源分配,从而优化应用程序在不同负载下的行为。

Clickhouse

  1. 高容量数据的实时分析:使用该插件将来自大规模系统的流式指标馈送到 ClickHouse 中。此设置支持超快的查询性能和近乎实时的分析,非常适合监控高流量应用程序。

  2. 时序数据仓库:将该插件与 ClickHouse 集成以创建强大的时序数据仓库。此用例允许组织存储详细的历史指标,并执行复杂的查询以进行趋势分析和容量规划。

  3. 分布式环境中的可扩展监控:利用该插件在 ClickHouse 中为每种指标类型动态创建表,从而更轻松地管理和查询来自大量分布式系统的数据,而无需预先定义模式。

  4. 物联网部署的优化存储:部署该插件以将来自物联网传感器的数据摄取到 ClickHouse 中。其高效的模式创建和原生类型映射有助于处理海量数据,从而实现实时监控和预测性维护。

反馈

感谢您成为我们社区的一份子!如果您有任何一般性反馈或在这些页面上发现了任何错误,我们欢迎并鼓励您提出意见。请在 InfluxDB 社区 Slack 中提交您的反馈。

强大性能,无限扩展

收集、组织和处理海量高速数据。当您将任何数据视为时序数据时,它都更有价值。借助 InfluxDB,排名第一的时序平台旨在通过 Telegraf 进行扩展。

查看入门方法

相关集成

HTTP 和 InfluxDB 集成

HTTP 插件从一个或多个 HTTP(S) 端点收集指标。它支持各种身份验证方法和数据格式的配置选项。

查看集成

Kafka 和 InfluxDB 集成

此插件从 Kafka 读取消息,并允许基于这些消息创建指标。它支持各种配置,包括不同的 Kafka 设置和消息处理选项。

查看集成

Kinesis 和 InfluxDB 集成

Kinesis 插件允许从 AWS Kinesis 流中读取指标。它支持多种输入数据格式,并提供带有 DynamoDB 的检查点功能,以实现可靠的消息处理。

查看集成