前言
- 简述：loki是由grafana开源的日志聚合系统，相较于ELK、EFK更轻量。
- loki特性：
- 不对日志进行全文索引。通过存储压缩非结构化日志和仅索引元数据，Loki 操作起来会更简单，更省成本。
- 通过使用与 Prometheus 相同的标签记录流对日志进行索引和分组，这使得日志的扩展和操作效率更高，能对接 alertmanager；
- 特别适合储存 Kubernetes Pod 日志；诸如 Pod 标签之类的元数据会被自动删除和编入索引；
- Grafana原生支持
- 版本：
- 系统：centos7
- loki：2.6.1
- promtail：2.6.1
- grafana: 8.3.3
本文以loki监控nginx日志为例。nginx日志所在目录为 /home/admin/apps/nginx/logs/
安装loki
docker方式
PS: 未经测试
docker pull grafana/loki wget https://raw.githubusercontent.com/grafana/loki/v2.6.1/cmd/loki/loki-local-config.yaml -O loki-config.yaml docker run --name loki -d -v $(pwd):/mnt/config -p 3100:3100 grafana/loki:2.6.1 -config.file=/mnt/config/loki-config.yaml
二进制方式
- 官方GitHub仓库的Release页下载压缩包并解压
- 编辑loki-config.yaml
auth_enabled: false server: http_listen_port: 3100 grpc_listen_port: 9096 ingester: wal: enabled: true dir: /home/apps/loki/wal lifecycler: address: 127.0.0.1 ring: kvstore: store: inmemory replication_factor: 1 final_sleep: 0s chunk_idle_period: 1h # Any chunk not receiving new logs in this time will be flushed max_chunk_age: 1h # All chunks will be flushed when they hit this age, default is 1h chunk_target_size: 1048576 # Loki will attempt to build chunks up to 1.5MB, flushing first if chunk_idle_period or max_chunk_age is reached first chunk_retain_period: 30s # Must be greater than index read cache TTL if using an index cache (Default index read cache TTL is 5m) max_transfer_retries: 0 # Chunk transfers disabled schema_config: configs: - from: 2020-10-24 store: boltdb-shipper object_store: filesystem schema: v11 index: prefix: index_ period: 24h storage_config: boltdb_shipper: active_index_directory: /home/apps/loki/boltdb-shipper-active cache_location: /home/apps/loki/boltdb-shipper-cache cache_ttl: 24h # Can be increased for faster performance over longer query periods, uses more disk space shared_store: filesystem filesystem: directory: /home/apps/loki/chunks compactor: working_directory: /home/apps/loki/boltdb-shipper-compactor shared_store: filesystem limits_config: reject_old_samples: true reject_old_samples_max_age: 168h chunk_store_config: max_look_back_period: 0s table_manager: retention_deletes_enabled: false retention_period: 0s ruler: storage: type: local local: directory: /home/apps/loki/rules rule_path: /home/apps/loki/rules-temp alertmanager_url: http://localhost:9093 ring: kvstore: store: inmemory enable_api: true
- 启动
./loki -config.file=loki-config.yaml > /dev/null 2>&1 &
安装promtail
docker方式
PS: 未经测试
wget https://raw.githubusercontent.com/grafana/loki/v2.6.1/clients/cmd/promtail/promtail-docker-config.yaml -O promtail-config.yaml docker run --name promtail -d -v $(pwd):/mnt/config -v /var/log:/var/log --link loki grafana/promtail:2.6.1 -config.file=/mnt/config/promtail-config.yaml
二进制方式
- 官方GitHub仓库Release页下载压缩包并解压
- 编辑promtail-config.yaml
server: http_listen_port: 9080 grpc_listen_port: 0 positions: filename: /tmp/positions.yaml clients: - url: http://192.168.2.249:3100/loki/api/v1/push scrape_configs: - job_name: nginx static_configs: - targets: - 192.168.2.249 labels: job: varlogs __path__: /home/admin/apps/nginx/logs/*log
- 启动
nohup ./promtail -config.file=promtail-config.yaml > /dev/null 2>&1 &
安装grafana
- 创建容器并运行
docker pull 'grafana/grafana:latest' docker run --name grafana -p 3000:3000 -d 'grafana/grafana:latest'
- 浏览器访问ip:3000，账密默认为：admin/admin
- 配置loki数据源
