Grafana分析Nginx日誌

按日期對ES的index進行分割:

logstash配置:

input{ file{ path => "/home/hottopic/logs/trend-shotting-api/metric/*" type => "trend-shotting-api-metric" start_position => "beginning" codec => json { charset => "UTF-8" } } } output{ if [type] == "trend-shotting-api-metric" { elasticsearch { hosts=> ["172.17.213.60:9200"] index=> "trend-shotting-api-metrick.%{+YYYY-MM}" } } }

grafana源配置：(注意日期格式要統一，好比YYYY-MM或YYYY.MM)

 

---

 

配置Groub by -Terms時報錯，提示須要設置fielddata=true，報錯內容大概以下： 

"Fielddata is disabled on text fields by default ... "

 

解決方法以下：

https://www.elastic.co/guide/en/elasticsearch/reference/current/fielddata.html#_fielddata_is_disabled_on_literal_text_literal_fields_by_default

curl -X PUT "localhost:9200/nginx/_mapping/doc" -H 'Content-Type: application/json' -d' { "properties": { "xforward": { "type":     "text", "fielddata": true } } } '

 

操做後仍然報錯，因而

curl -X PUT "localhost:9200/nginx/_mapping/doc?update_all_types" -H 'Content-Type: application/json' -d'         
{ "properties": { "xforward": { "type":     "text", "fielddata": true } } } '

以上nginx爲index名稱  xforward爲字段名稱。

修改完後查看結果顯示已修改爲功

 返回到Grafana進行再一次設置

 

修改爲功後，能夠正常出圖。