1. 程式人生 > >用Flume採集多臺機器上的多種日誌並存儲於HDFS

用Flume採集多臺機器上的多種日誌並存儲於HDFS

需求:

把A、B 機器中的access.log、ugcheader.log、ugctail.log 彙總到C機器上然後統一收集到hdfs中。
IP: A:155 B:156 C:162
但是在hdfs中要求的目錄為:
/source/access/20160101/**
/source/ugcheader/20160101/**
/source/ugctail/20160101/**

結構:

這裡寫圖片描述
B機器同A機器。

Conf:

A機器:

# Name the components on this agent
a1.sources = r1 r2 r3
a1.sinks = k1
a1.channels = c1

# Describe/configure the source
a1.sources.r1.type = exec a1.sources.r1.command = tail -F /opt/data/access.log a1.sources.r1.interceptors = i1 a1.sources.r1.interceptors.i1.type = static a1.sources.r1.interceptors.i1.key = type a1.sources.r1.interceptors.i1.value = access a1.sources.r2.type = exec a1.sources.r2.command = tail -F /opt/data/ugchead.log
a1.sources.r2.interceptors = i2 a1.sources.r2.interceptors.i2.type = static a1.sources.r2.interceptors.i2.key = type a1.sources.r2.interceptors.i2.value = ugchead a1.sources.r3.type = exec a1.sources.r3.command = tail -F /opt/data/ugctail.log a1.sources.r3.interceptors = i3 a1.sources.r3.interceptors
.i3.type = static a1.sources.r3.interceptors.i3.key = type a1.sources.r3.interceptors.i3.value = ugctail # Describe the sink a1.sinks.k1.type = avro a1.sinks.k1.hostname = 192.168.1.162 a1.sinks.k1.port = 41414 # Use a channel which buffers events in memory a1.channels.c1.type = memory a1.channels.c1.capacity = 1000 a1.channels.c1.transactionCapacity = 100 # Bind the source and sink to the channel a1.sources.r1.channels = c1 a1.sources.r2.channels = c1 a1.sources.r3.channels = c1 a1.sinks.k1.channel = c1

B機器同A機器。

C機器:

a1.sources = r1
a1.sinks = k1
a1.channels = c1

# Describe/configure the source
a1.sources.r1.type = avro
a1.sources.r1.bind = 0.0.0.0
a1.sources.r1.port = 44444

# source r1定義攔截器,為訊息新增時間戳
a1.sources.r1.interceptors = i1
a1.sources.r1.interceptors.i1.type = org.apache.flume.interceptor.TimestampInterceptor$Builder


#具體定義sink
a1.sinks.k1.type = hdfs
a1.sinks.k1.hdfs.path = hdfs://192.168.1.156:9000/source/%{type}/%Y%m%d
#指定檔案字首
a1.sinks.k1.hdfs.filePrefix = events-
#不壓縮
a1.sinks.k1.hdfs.fileType = DataStream
#如果壓縮指定壓縮的方式
#a1.sinks.k1.hdfs.fileType = CompressedStream
#a1.sinks.k1.hdfs.codeC = gzip
#不按照條數生成檔案
a1.sinks.k1.hdfs.rollCount = 0
#如果壓縮儲存的話HDFS上的檔案達到64M時生成一個檔案注意是壓縮前大小為64生成一個檔案,然後壓縮儲存。
a1.sinks.k1.hdfs.rollSize = 67108864
a1.sinks.k1.hdfs.rollInterval = 0

# Use a channel which buffers events in memory
a1.channels.c1.type = memory
a1.channels.c1.capacity = 10000
a1.channels.c1.transactionCapacity = 1000

# Bind the source and sink to the channel
a1.sources.r1.channels = c1
a1.sinks.k1.channel = c1