# 步骤1：安装Java环境
$ yum install -y java-11-openjdk java-11-openjdk-devel

$ java -version
openjdk version “11.0.2” 2019-01-15 LTS
OpenJDK Runtime Environment 18.9 (build 11.0.2+9-LTS)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.2+9-LTS, mixed mode, sharing)

# 步骤2：添加Elasticsearch仓库
$ rpm –import https://artifacts.elastic.co/GPG-KEY-elasticsearch

$ vi /etc/yum.repos.d/elasticsearch.repo
[elasticsearch]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

# 步骤3：安装Elasticsearch
$ yum install -y elasticsearch

# 步骤4：配置Elasticsearch
$ vi /etc/elasticsearch/elasticsearch.yml

cluster.name: ogg-elk-cluster
node.name: node-1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: [“192.168.1.100”, “192.168.1.101”, “192.168.1.102”]
cluster.initial_master_nodes: [“node-1”, “node-2”, “node-3”]

# 步骤5：配置JVM内存
$ vi /etc/elasticsearch/jvm.options

-Xms16g
-Xmx16g

# 步骤6：启动Elasticsearch
$ systemctl daemon-reload
$ systemctl enable elasticsearch
$ systemctl start elasticsearch

# 步骤7：验证安装
$ curl -X GET “localhost:9200”

{
“name” : “node-1”,
“cluster_name” : “ogg-elk-cluster”,
“cluster_uuid” : “xxx-xxx-xxx”,
“version” : {
“number” : “7.17.0”,
“build_flavor” : “default”,
“build_type” : “rpm”,
“build_hash” : “xxx”,
“build_date” : “2022-01-28T08:36:04.875279988Z”,
“build_snapshot” : false,
“lucene_version” : “8.11.1”,
“minimum_wire_compatibility_version” : “6.8.0”,
“minimum_index_compatibility_version” : “6.0.0-beta1”
},
“tagline” : “You Know, for Search”
}

# 步骤8：检查集群状态
$ curl -X GET “localhost:9200/_cluster/health?pretty”

{
“cluster_name” : “ogg-elk-cluster”,
“status” : “green”,
“timed_out” : false,
“number_of_nodes” : 3,
“number_of_data_nodes” : 3,
“active_primary_shards” : 1,
“active_shards” : 2,
“relocating_shards” : 0,
“initializing_shards” : 0,
“unassigned_shards” : 0,
“delayed_unassigned_shards” : 0,
“number_of_pending_tasks” : 0,
“number_of_in_flight_fetch” : 0,
“task_max_waiting_in_queue_millis” : 0,
“active_shards_percent_as_number” : 100.0
}

# 步骤1：安装Logstash
$ yum install -y logstash

# 步骤2：配置Logstash
$ vi /etc/logstash/logstash.yml

path.data: /var/lib/logstash
path.config: /etc/logstash/conf.d
path.logs: /var/log/logstash

# 步骤3：创建OGG日志处理配置
$ vi /etc/logstash/conf.d/ogg-log.conf

input {
beats {
port => 5044
}
}

filter {
if [fields][log_type] == “ogg-process” {
grok {
match => {
“message” => [
“%{TIMESTAMP_ISO8601:timestamp}\s+%{WORD:log_level}\s+OGG-%{NUMBER:error_code}\s+%{GREEDYDATA:error_message}”,
“%{TIMESTAMP_ISO8601:timestamp}\s+%{WORD:log_level}\s+%{GREEDYDATA:message}”
]
}
}

date {
match => [“timestamp”, “yyyy-MM-dd HH:mm:ss”]
target => “@timestamp”
}

mutate {
add_field => {
“process_type” => “%{[fields][process_type]}”
“process_name” => “%{[fields][process_name]}”
}
}

if [error_code] {
mutate {
add_tag => [“error”]
}
}
}
}

output {
if [fields][log_type] == “ogg-process” {
elasticsearch {
hosts => [“http://localhost:9200”]
index => “ogg-log-%{+YYYY.MM.dd}”
}
}
}

# 步骤4：启动Logstash
$ systemctl enable logstash
$ systemctl start logstash

# 步骤5：验证Logstash状态
$ systemctl status logstash

● logstash.service – Logstash
Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled)
Active: active (running) since Fri 2026-04-10 10:00:00 CST; 1min ago
Main PID: 12345 (java)
CGroup: /system.slice/logstash.service
└─12345 /usr/share/logstash/jdk/bin/java …

# 步骤6：检查端口监听
$ netstat -tlnp | grep 5044

tcp6 0 0 :::5044 :::* LISTEN 12345/java

# 步骤1：安装Kibana
$ yum install -y kibana

# 步骤2：配置Kibana
$ vi /etc/kibana/kibana.yml

server.port: 5601
server.host: “0.0.0.0”
elasticsearch.hosts: [“http://localhost:9200”]
kibana.index: “.kibana”

# 步骤3：启动Kibana
$ systemctl enable kibana
$ systemctl start kibana

# 步骤4：访问Kibana
http://192.168.1.100:5601

# 步骤5：创建索引模式
# 在Kibana界面操作：
# 1. 进入 Management -> Index Patterns
# 2. 点击 “Create index pattern”
# 3. 输入索引模式：ogg-log-*
# 4. 选择时间字段：@timestamp
# 5. 点击 “Create index pattern”

# 步骤1：创建完整的OGG日志解析配置
$ vi /etc/logstash/conf.d/ogg-complete.conf

input {
beats {
port => 5044
tags => [“ogg”]
}
}

filter {
# 解析OGG进程报告日志
if [fields][log_type] == “ogg-report” {
grok {
match => {
“message” => [
# 匹配进程状态信息
“^%{WORD:process_type}\s+%{WORD:process_name}\s+Last Started %{TIMESTAMP_ISO8601:last_start}\s+Status %{WORD:status}”,
# 匹配检查点延迟
“^Checkpoint Lag\s+%{TIME:checkpoint_lag}”,
# 匹配Trail文件信息
“^Trail File Seqno\s+%{NUMBER:trail_seq}”,
# 匹配错误信息
“^%{TIMESTAMP_ISO8601:timestamp}\s+%{WORD:log_level}\s+OGG-%{NUMBER:error_code}”,
# 匹配一般信息
“^%{TIMESTAMP_ISO8601:timestamp}\s+%{WORD:log_level}\s+%{GREEDYDATA:log_message}”
]
}
tag_on_failure => [“_grokparsefailure_ogg”]
}

# 时间解析
if [timestamp] {
date {
match => [“timestamp”, “yyyy-MM-dd HH:mm:ss”]
target => “@timestamp”
}
}

# 添加字段
mutate {
add_field => {
“log_source” => “ogg”
“host_name” => “%{[host][name]}”
}
}

# 错误标记
if [error_code] {
mutate {
add_tag => [“error”, “ogg-error”]
}
}

# 警告标记
if [log_level] == “WARNING” {
mutate {
add_tag => [“warning”, “ogg-warning”]
}
}
}

# 解析OGG错误日志
if [fields][log_type] == “ogg-error” {
grok {
match => {
“message” => [
“^%{TIMESTAMP_ISO8601:timestamp}\s+%{WORD:log_level}\s+OGG-%{NUMBER:error_code}\s+%{GREEDYDATA:error_message}”
]
}
}

mutate {
add_tag => [“error”, “ogg-error”]
}
}

# 解析OGG丢弃日志
if [fields][log_type] == “ogg-discard” {
grok {
match => {
“message” => [
“^%{TIMESTAMP_ISO8601:timestamp}\s+Discarding record at seqno %{NUMBER:seqno} rba %{NUMBER:rba}”
]
}
}

mutate {
add_tag => [“discard”, “ogg-discard”]
}
}
}

output {
# 输出到Elasticsearch
elasticsearch {
hosts => [“http://localhost:9200”]
index => “ogg-log-%{+YYYY.MM.dd}”
template_name => “ogg-log”
template_overwrite => true
}

# 错误日志额外输出到文件
if “error” in [tags] {
file {
path => “/var/log/logstash/ogg-errors.log”
}
}
}

# 步骤2：创建索引模板
$ curl -X PUT “localhost:9200/_template/ogg-log” -H ‘Content-Type: application/json’ -d’
{
“index_patterns”: [“ogg-log-*”],
“settings”: {
“number_of_shards”: 3,
“number_of_replicas”: 1
},
“mappings”: {
“properties”: {
“@timestamp”: { “type”: “date” },
“process_type”: { “type”: “keyword” },
“process_name”: { “type”: “keyword” },
“status”: { “type”: “keyword” },
“log_level”: { “type”: “keyword” },
“error_code”: { “type”: “keyword” },
“error_message”: { “type”: “text” },
“checkpoint_lag”: { “type”: “keyword” },
“trail_seq”: { “type”: “integer” },
“host_name”: { “type”: “keyword” },
“message”: { “type”: “text” }
}
}
}’

# 步骤3：重启Logstash
$ systemctl restart logstash
from GoldenGate视频:www.itpux.com

# 步骤1：在OGG服务器安装Filebeat
$ yum install -y filebeat

# 步骤2：配置Filebeat
$ vi /etc/filebeat/filebeat.yml

filebeat.inputs:
# OGG进程报告日志
– type: log
enabled: true
paths:
– /GoldenGate/app/dirrpt/*.rpt
fields:
log_type: ogg-report
fields_under_root: false
multiline:
pattern: ‘^[0-9]{4}-[0-9]{2}-[0-9]{2}’
negate: true
match: after

# OGG错误日志
– type: log
enabled: true
paths:
– /GoldenGate/app/dirrpt/*.err
fields:
log_type: ogg-error
fields_under_root: false

# OGG丢弃日志
– type: log
enabled: true
paths:
– /GoldenGate/app/dirrpt/*.dsc
fields:
log_type: ogg-discard
fields_under_root: false

# OGG Manager日志
– type: log
enabled: true
paths:
– /GoldenGate/app/dirrpt/MGR.rpt
fields:
log_type: ogg-manager
fields_under_root: false

# 输出到Logstash
output.logstash:
hosts: [“192.168.1.100:5044”]
bulk_max_size: 2048

# 处理器
processors:
– add_host_metadata:
when.not.contains.tags: forwarded
– add_cloud_metadata: ~
– add_docker_metadata: ~

# 步骤3：启动Filebeat
$ systemctl enable filebeat
$ systemctl start filebeat

# 步骤4：验证日志采集
$ curl -X GET “localhost:9200/ogg-log-*/_search?pretty&size=1”

{
“took” : 5,
“timed_out” : false,
“_shards” : {
“total” : 3,
“successful” : 3,
“skipped” : 0,
“failed” : 0
},
“hits” : {
“total” : {
“value” : 1000,
“relation” : “eq”
},
“max_score” : 1.0,
“hits” : [
{
“_index” : “ogg-log-2026.04.10”,
“_type” : “_doc”,
“_id” : “xxx”,
“_score” : 1.0,
“_source” : {
“@timestamp” : “2026-04-10T10:00:00.000Z”,
“host” : {
“name” : “fgedu.net.cn”
},
“log_level” : “INFO”,
“message” : “Process E_FGEDU01 is running”,
“process_name” : “E_FGEDU01”,
“process_type” : “EXTRACT”,
“status” : “RUNNING”
}
}
]
}
}

# 步骤1：创建索引模式
# 在Kibana界面：
# 1. Management -> Index Patterns -> Create index pattern
# 2. Index pattern name: ogg-log-*
# 3. Time field: @timestamp

# 步骤2：创建可视化图表

# 图表1：进程状态饼图
# Visualization -> Create visualization -> Pie
# Index pattern: ogg-log-*
# Aggregation: Terms
# Field: status.keyword

# 图表2：延迟趋势折线图
# Visualization -> Create visualization -> Line
# Index pattern: ogg-log-*
# X-axis: Date Histogram, Field: @timestamp
# Y-axis: Average, Field: checkpoint_lag_seconds

# 图表3：错误统计柱状图
# Visualization -> Create visualization -> Vertical Bar
# Index pattern: ogg-log-*
# X-axis: Date Histogram, Field: @timestamp
# Y-axis: Count
# Split series: Filter, query: tags: “error”

# 图表4：错误类型表格
# Visualization -> Create visualization -> Data Table
# Index pattern: ogg-log-*
# Buckets: Split rows
# Aggregation: Terms, Field: error_code.keyword
# Metric: Count

# 步骤3：创建仪表板
# Dashboard -> Create new dashboard

# 添加以下可视化：
# 1. 进程状态饼图
# 2. 延迟趋势折线图
# 3. 错误统计柱状图
# 4. 错误类型表格
# 5. 关键指标卡片

# 步骤4：配置告警
# 在Kibana界面：
# 1. Management -> Watcher
# 2. Create Watch

# 示例告警配置
{
“trigger”: {
“schedule”: {
“interval”: “1m”
}
},
“input”: {
“search”: {
“request”: {
“indices”: [“ogg-log-*”],
“body”: {
“query”: {
“bool”: {
“must”: [
{
“range”: {
“@timestamp”: {
“from”: “now-5m”
}
}
},
{
“term”: {
“tags”: “error”
}
}
]
}
}
}
}
}
},
“condition”: {
“compare”: {
“ctx.payload.hits.total”: {
“gt”: 0
}
}
},
“actions”: {
“email_admin”: {
“email”: {
“to”: “dba@fgedu.net.cn”,
“subject”: “OGG Error Alert”,
“body”: “Found {{ctx.payload.hits.total}} errors in the last 5 minutes”
}
}
}
}

# 步骤5：保存仪表板
# Dashboard -> Save -> “OGG监控仪表板”

# 步骤1：创建常用搜索

# 搜索1：错误日志搜索
# Discover -> Create search
# Query: tags: “error”
# Save as: “OGG错误日志”

# 搜索2：特定进程日志
# Query: process_name: “E_FGEDU01”
# Save as: “E_FGEDU01进程日志”

# 搜索3：延迟告警日志
# Query: checkpoint_lag_seconds: >60
# Save as: “OGG延迟告警”

# 步骤2：创建搜索模板脚本
#!/bin/bash
# ogg_log_search.sh
# from:www.itpux.com.qq113257174.wx:itpux-com
# web: http://www.fgedu.net.cn

ES_HOST=”localhost:9200″
INDEX=”ogg-log-*”

# 搜索错误日志
search_errors() {
local hours=$1

curl -s -X GET “${ES_HOST}/${INDEX}/_search” -H ‘Content-Type: application/json’ -d’
{
“query”: {
“bool”: {
“must”: [
{
“term”: {
“tags”: “error”
}
},
{
“range”: {
“@timestamp”: {
“gte”: “now-‘${hours}’h”
}
}
}
]
}
},
“sort”: [
{
“@timestamp”: {
“order”: “desc”
}
}
],
“size”: 100
}’ | jq ‘.hits.hits[]._source’
}

# 搜索特定进程日志
search_process() {
local process_name=$1

curl -s -X GET “${ES_HOST}/${INDEX}/_search” -H ‘Content-Type: application/json’ -d’
{
“query”: {
“term”: {
“process_name”: “‘${process_name}'”
}
},
“sort”: [
{
“@timestamp”: {
“order”: “desc”
}
}
],
“size”: 50
}’ | jq ‘.hits.hits[]._source’
}

# 统计错误数量
count_errors() {
local hours=$1

curl -s -X GET “${ES_HOST}/${INDEX}/_count” -H ‘Content-Type: application/json’ -d’
{
“query”: {
“bool”: {
“must”: [
{
“term”: {
“tags”: “error”
}
},
{
“range”: {
“@timestamp”: {
“gte”: “now-‘${hours}’h”
}
}
}
]
}
}
}’ | jq ‘.count’
}

case “$1” in
errors)
search_errors $2
;;
process)
search_process $2
;;
count)
count_errors $2
;;
*)
echo “用法: $0 {errors|process|count} [参数]”
;;
esac

# 使用示例
$ ./ogg_log_search.sh errors 24
$ ./ogg_log_search.sh process E_FGEDU01
$ ./ogg_log_search.sh count 1

# 项目背景
– 环境：20套OGG同步链路
– 日志量：约50GB/天
– 要求：集中管理、快速检索、可视化分析

# 实施架构
+——————+ +——————+ +——————+
| OGG服务器1 | | OGG服务器2 | | OGG服务器N |
| Filebeat | | Filebeat | | Filebeat |
+——————+ +——————+ +——————+
| | |
+————————+————————+
|
v
+——————+
| Kafka集群 |
| (日志缓冲) |
+——————+
|
v
+——————+
| Logstash集群 |
| (日志处理) |
+——————+
|
v
+——————+
| Elasticsearch |
| (3节点集群) |
+——————+
|
v
+——————+
| Kibana |
| (可视化) |
+——————+

# 实施效果
1. 日志集中管理：所有OGG日志集中存储
2. 快速检索：秒级检索历史日志
3. 可视化分析：实时监控仪表板
4. 告警通知：自动告警异常情况
5. 合规审计：满足审计要求

# 关键指标
| 指标 | 实施前 | 实施后 | 改善 |
|—————|————-|————-|———-|
| 问题定位时间 | 2小时 | 10分钟 | 90% |
| 日志检索时间 | 30分钟 | 10秒 | 99% |
| 告警响应时间 | 30分钟 | 5分钟 | 83% |
| 运维效率 | 基准 | 提升3倍 | 200% |

# 仪表板展示内容
1. 总览仪表板
– 进程状态总览
– 关键指标汇总
– 最近告警列表

2. 运维仪表板
– 进程详细状态
– 延迟趋势图
– 性能指标图

3. 分析仪表板
– 日志趋势分析
– 错误分类统计
– 容量规划分析

# 问题1：日志解析失败
# 现象
日志显示_grokparsefailure标签

# 原因分析
Grok模式不匹配日志格式

# 解决方案
# 1. 分析日志格式
# 2. 调整Grok模式
# 3. 使用Grok Debugger调试

# 在Kibana Dev Tools中调试
POST _ingest/pipeline/_simulate
{
“pipeline”: {
“processors”: [
{
“grok”: {
“field”: “message”,
“patterns”: [“%{TIMESTAMP_ISO8601:timestamp} %{WORD:level} %{GREEDYDATA:msg}”]
}
}
]
},
“docs”: [
{
“_source”: {
“message”: “2026-04-10 10:00:00 INFO Process started”
}
}
]
}

# 问题2：存储空间不足
# 现象
Elasticsearch索引写入失败

# 解决方案
# 1. 配置索引生命周期管理
PUT _ilm/policy/ogg-log-policy
{
“policy”: {
“phases”: {
“hot”: {
“min_age”: “0ms”,
“actions”: {
“rollover”: {
“max_size”: “50gb”,
“max_age”: “1d”
}
}
},
“warm”: {
“min_age”: “7d”,
“actions”: {
“forcemerge”: {
“max_num_segments”: 1
}
}
},
“delete”: {
“min_age”: “30d”,
“actions”: {
“delete”: {}
}
}
}
}
}

# 问题3：查询性能慢
# 现象
Kibana查询响应时间长

# 解决方案
# 1. 优化索引设置
PUT ogg-log-*/_settings
{
“index”: {
“refresh_interval”: “30s”,
“number_of_replicas”: 1
}
}

# 2. 使用时间范围过滤
# 3. 避免通配符查询

# 解决方案1：完整日志分析脚本
#!/bin/bash
# ogg_log_analysis.sh
# from:www.itpux.com.qq113257174.wx:itpux-com
# web: http://www.fgedu.net.cn

ES_HOST=”localhost:9200″
INDEX=”ogg-log-*”
REPORT_FILE=”/GoldenGate/app/logs/log_analysis_report.txt”

generate_report() {
echo “=== OGG日志分析报告 ===” > $REPORT_FILE
echo “生成时间: $(date)” >> $REPORT_FILE
echo “” >> $REPORT_FILE

# 统计今日错误数量
echo “今日错误统计:” >> $REPORT_FILE
curl -s -X GET “${ES_HOST}/${INDEX}/_count” -H ‘Content-Type: application/json’ -d’
{
“query”: {
“bool”: {
“must”: [
{“term”: {“tags”: “error”}},
{“range”: {“@timestamp”: {“gte”: “now/d”}}}
]
}
}
}’ | jq ‘.count’ >> $REPORT_FILE

# 统计各进程状态
echo “” >> $REPORT_FILE
echo “进程状态统计:” >> $REPORT_FILE
curl -s -X GET “${ES_HOST}/${INDEX}/_search” -H ‘Content-Type: application/json’ -d’
{
“size”: 0,
“aggs”: {
“process_status”: {
“terms”: {
“field”: “status.keyword”
}
}
}
}’ | jq ‘.aggregations.process_status.buckets[]’ >> $REPORT_FILE

# 统计错误类型分布
echo “” >> $REPORT_FILE
echo “错误类型分布:” >> $REPORT_FILE
curl -s -X GET “${ES_HOST}/${INDEX}/_search” -H ‘Content-Type: application/json’ -d’
{
“size”: 0,
“query”: {
“term”: {“tags”: “error”}
},
“aggs”: {
“error_types”: {
“terms”: {
“field”: “error_code.keyword”,
“size”: 10
}
}
}
}’ | jq ‘.aggregations.error_types.buckets[]’ >> $REPORT_FILE

echo “” >> $REPORT_FILE
echo “=== 报告结束 ===” >> $REPORT_FILE
}

generate_report
cat $REPORT_FILE

# 解决方案2：日志告警脚本
#!/bin/bash
# ogg_log_alert.sh
# from:www.itpux.com.qq113257174.wx:itpux-com
# web: http://www.fgedu.net.cn

ES_HOST=”localhost:9200″
INDEX=”ogg-log-*”
ALERT_THRESHOLD=5

check_errors() {
error_count=$(curl -s -X GET “${ES_HOST}/${INDEX}/_count” -H ‘Content-Type: application/json’ -d’
{
“query”: {
“bool”: {
“must”: [
{“term”: {“tags”: “error”}},
{“range”: {“@timestamp”: {“gte”: “now-5m”}}}
]
}
}
}’ | jq ‘.count’)

if [ $error_count -gt $ALERT_THRESHOLD ]; then
# 发送告警
echo “发现 $error_count 个错误，超过阈值 $ALERT_THRESHOLD”

# 获取错误详情
curl -s -X GET “${ES_HOST}/${INDEX}/_search” -H ‘Content-Type: application/json’ -d’
{
“query”: {
“bool”: {
“must”: [
{“term”: {“tags”: “error”}},
{“range”: {“@timestamp”: {“gte”: “now-5m”}}}
]
}
},
“sort”: [{“@timestamp”: “desc”}],
“size”: 10
}’ | jq ‘.hits.hits[]._source’
fi
}

check_errors