ES + SkyWalking + Spring Boot：日志分析与服务监控（三）

一、搭建SkyWalking

1.1 版本选择

1.2 下载安装

1.3 配置启动

1.4 SkyWalking UI介绍

二、Springboot项目使用

2.1 Agent下载

2.2 Agent配置skywalking oap地址

2.3 IDEA配置Agent地址

2.4 生成的ES索引介绍

三、在kibana上查看日志

四、问题和解决

3.1 日志显示没有按照时间排序

3.2 索引模版失效

一、搭建SkyWalking

1.1 版本选择

项目的JDK版本使用的JDK8，SkyWalking 9.x版本要求JDK版本至少为11，因此选择8.*，这里选择 8.9.1

开始安装9.4版本后查看启动日志报错：

Exception in thread "main" java.lang.UnsupportedClassVersionError: org/apache/skywalking/oap/server/starter/OAPServerStartUp has been compiled by a more recent version of the Java Runtime (class file version 55.0), this version of the Java Runtime only recognizes class file versions up to 52.0

版本问题：kyWalking需要JDK11或JDK17。如果您使用的Java版本只识别52.0以下的类文件版本，则意味着您使用的是Java 8。您需要将Java版本升级到JDK11或JDK17来解决这个问题。下面是启动后端的步骤：确保系统上安装了JDK11或JDK17。

1.2 下载安装

在虚拟机上安装。

下载链接：https://archive.apache.org/dist/skywalking/ 下选择版

wget https://archive.apache.org/dist/skywalking/8.9.1/apache-skywalking-apm-8.9.1.tar.gz
tar -xzf apache-skywalking-apm-8.9.1.tar.gz

1.3 配置启动

修改配置端口：apache-skywalking-apm-bin/webapp/webapp.yml

默认8080，修改为8100

server:port: 8100spring:discovery:client:simple:instances:oap-service:- uri: http://192.168.64.128:12800//修改为ip

修改apache-skywalking-apm-bin/config/application.yml配置：

选择elasticsearch进行存储

storage:selector: ${SW_STORAGE:elasticsearch}elasticsearch:namespace: ${SW_NAMESPACE:"hbintrade-framework"}clusterNodes: ${SW_STORAGE_ES_CLUSTER_NODES:192.168.64.128:9200} #注意改成ipprotocol: ${SW_STORAGE_ES_HTTP_PROTOCOL:"http"}connectTimeout: ${SW_STORAGE_ES_CONNECT_TIMEOUT:500}socketTimeout: ${SW_STORAGE_ES_SOCKET_TIMEOUT:30000}numHttpClientThread: ${SW_STORAGE_ES_NUM_HTTP_CLIENT_THREAD:0}user: ${SW_ES_USER:"elastic"} # es用户名密码password: ${SW_ES_PASSWORD:"123456"}trustStorePath: ${SW_STORAGE_ES_SSL_JKS_PATH:""}trustStorePass: ${SW_STORAGE_ES_SSL_JKS_PASS:""}secretsManagementFile: ${SW_ES_SECRETS_MANAGEMENT_FILE:""} # Secrets management file in the properties format includes the username, password, which are managed by 3rd party tool.dayStep: ${SW_STORAGE_DAY_STEP:1} # Represent the number of days in the one minute/hour/day index.indexShardsNumber: ${SW_STORAGE_ES_INDEX_SHARDS_NUMBER:1} # Shard number of new indexesindexReplicasNumber: ${SW_STORAGE_ES_INDEX_REPLICAS_NUMBER:1} # Replicas number of new indexes# Super data set has been defined in the codes, such as trace segments.The following 3 config would be improve es performance when storage super size data in es.superDatasetDayStep: ${SW_SUPERDATASET_STORAGE_DAY_STEP:-1} # Represent the number of days in the super size dataset record index, the default value is the same as dayStep when the value is less than 0superDatasetIndexShardsFactor: ${SW_STORAGE_ES_SUPER_DATASET_INDEX_SHARDS_FACTOR:5} #  This factor provides more shards for the super data set, shards number = indexShardsNumber * superDatasetIndexShardsFactor. Also, this factor effects Zipkin and Jaeger traces.superDatasetIndexReplicasNumber: ${SW_STORAGE_ES_SUPER_DATASET_INDEX_REPLICAS_NUMBER:0} # Represent the replicas number in the super size dataset record index, the default value is 0.indexTemplateOrder: ${SW_STORAGE_ES_INDEX_TEMPLATE_ORDER:0} # the order of index templatebulkActions: ${SW_STORAGE_ES_BULK_ACTIONS:5000} # Execute the async bulk record data every ${SW_STORAGE_ES_BULK_ACTIONS} requests# flush the bulk every 10 seconds whatever the number of requests# INT(flushInterval * 2/3) would be used for index refresh period.flushInterval: ${SW_STORAGE_ES_FLUSH_INTERVAL:15}concurrentRequests: ${SW_STORAGE_ES_CONCURRENT_REQUESTS:2} # the number of concurrent requestsresultWindowMaxSize: ${SW_STORAGE_ES_QUERY_MAX_WINDOW_SIZE:10000}metadataQueryMaxSize: ${SW_STORAGE_ES_QUERY_MAX_SIZE:5000}segmentQueryMaxSize: ${SW_STORAGE_ES_QUERY_SEGMENT_SIZE:200}profileTaskQueryMaxSize: ${SW_STORAGE_ES_QUERY_PROFILE_TASK_SIZE:200}oapAnalyzer: ${SW_STORAGE_ES_OAP_ANALYZER:"{\"analyzer\":{\"oap_analyzer\":{\"type\":\"stop\"}}}"} # the oap analyzer.oapLogAnalyzer: ${SW_STORAGE_ES_OAP_LOG_ANALYZER:"{\"analyzer\":{\"oap_log_analyzer\":{\"type\":\"standard\"}}}"} # the oap log analyzer. It could be customized by the ES analyzer configuration to support more language log formats, such as Chinese log, Japanese log and etc.advanced: ${SW_STORAGE_ES_ADVANCED:""}

启动oap:

./bin/oapService.sh

查看启动日志：

apache-skywalking-apm-bin/logs/skywalking-oap-server.log

启动ui:

./bin/webappService.sh

访问：ip:8100/

1.4 SkyWalking UI介绍

Skywalking-UI 使用说明_skywalking-booster-ui-CSDN博客

二、Springboot项目使用

2.1 Agent下载

下载链接：Index of /dist/skywalking/java-agent 选择对应版本

将其放到本地，Springboot项目也在本地。

2.2 Agent配置skywalking oap地址

skywalking-agent\config\agent.config

collector.backend_service=${SW_AGENT_COLLECTOR_BACKEND_SERVICES:192.168.64.128:11800}

2.3 IDEA配置Agent地址

启动项目后查看UI上面已经有日志了（注意筛选时间选择）

2.4 生成的ES索引介绍

*-log 是生成的项目日志
_segment 索引是用于存储跟踪数据的片段
_metrics-* 索引记录各种性能指标
*_relation_client_side 索引记录服务实例之间、端点之间的关系数据

三、在kibana上查看日志

在UI上看到日志不太方便，详细信息都要点进去查看，可以在kibana上看的更直观一些。

创建索引模式时，发现没有可选的时间戳进行时间筛选，导致日志显示也没有按照时间排序，是因为默认的索引模版timestamp字段默认是Long类型，需要转成date类型。

注意：

索引模式需要匹配上
索引别名必须写，否则skywalking UI上日志查询会报错
skywalking内有内置模版，需要删除旧模版创建新模版（或者将新模版的优先级>100，这个没有测试）
在Elasticsearch 7.x及更早版本中，_template端点用于管理索引模板。然而，从Elasticsearch 7.8版本开始，官方推荐使用新的索引模板API（即_index_template），因为旧版本的模板API将在未来的版本中弃用。

查询旧模版：

GET _index_template/

创建索引模版：

PUT _index_template/log_template_name  
{"priority": 101,"index_patterns": ["hbintrade-framework_log-*"],"template": {"mappings": {"properties": {"content": {"type": "keyword","copy_to": ["content_match"]},"content_match": {"type": "text"},"content_type": {"type": "integer","index": false},"endpoint_id": {"type": "keyword"},"endpoint_name": {"type": "keyword","copy_to": ["endpoint_name_match"]},"endpoint_name_match": {"type": "text"},"service_id": {"type": "keyword"},"service_instance_id": {"type": "keyword"},"span_id": {"type": "integer"},"tags": {"type": "keyword"},"tags_raw_data": {"type": "binary"},"time_bucket": {"type": "date","format": "yyyyMMddHHmmss"},"timestamp": {"type": "date"},"trace_id": {"type": "keyword"},"trace_segment_id": {"type": "keyword"},"unique_id": {"type": "keyword"}}},"aliases": {"hbintrade-framework_log": {}}}
}

删除log索引，再次生成索引后生效。

查看日志：

因为字段较多，可以在左侧选定字段查看