Flume collects logs, writes to hdfs
Install flume first:
It is recommended to maintain a unified user with Hadoop to install Hadoop,flume
This time I use Hadoop users to install flume
Http://douya.blog.51cto.com/6173221/1860390
Start the configuration:
1. Write the configuration file:
Vim flume_hdfs.conf
# Define a memory channel called ch2 on agent1
Agent1.channels.ch2.type = memory
Agent1.channels.ch2.capacity = 10000
Agent1.channels.ch2.transactionCapacity = 100
# agent1.channels.ch2.keep-alive = 30
# define source monitor a file
Agent1.sources.avro-source1.type = exec
Agent1.sources.avro-source1.shell = / bin/bash-c
Agent1.sources.avro-source1.command = tail-n + 0-F / root/logs/appcenter.log
Agent1.sources.avro-source1.channels = ch2
Agent1.sources.avro-source1.threads = 5
Agent1.sources.avro-source1.interceptors = i1
Agent1.sources.avro-source1.interceptors.i1.type = org.apache.flume.interceptor.TimestampInterceptor$Builder
# Define a logger sink that simply logs all events it receives
# and connect it to the other end of the same channel.
Agent1.sinks.log-sink1.channel = ch2
Agent1.sinks.log-sink1.type = hdfs
Agent1.sinks.log-sink1.hdfs.path = hdfs://ns1/flume/%y%m%d
Agent1.sinks.log-sink1.hdfs.writeFormat = events-
Agent1.sinks.log-sink1.hdfs.fileType = DataStream
Agent1.sinks.log-sink1.hdfs.rollInterval = 60
Agent1.sinks.log-sink1.hdfs.rollSize = 134217728
Agent1.sinks.log-sink1.hdfs.rollCount = 0
# agent1.sinks.log-sink1.hdfs.batchSize = 100000
# agent1.sinks.log-sink1.hdfs.txnEventMax = 100000
# agent1.sinks.log-sink1.hdfs.callTimeout = 60000
# agent1.sinks.log-sink1.hdfs.appendTimeout = 60000
# Finally, now that we've defined all of our components, tell
# agent1 which ones we want to activate.
Agent1.channels = ch2
Agent1.sources = avro-source1
Agent1.sinks = log-sink1
2, provided that the Hadoop cluster starts normally and is available,
3. Start flume and start collecting logs
Start:
Flume-ng agent-c / usr/local/ELK/apache-flume/conf/-f / usr/local/ELK/apache-flume/conf/flume_hdfs.conf-Dflume.root.logger=INFO,console-n agent1
Error one:
2016-12-06 11 org.apache.flume.sink.hdfs.BucketWriter.open 24 org.apache.flume.sink.hdfs.BucketWriter.open 49036 (SinkRunner-PollingRunner-DefaultSinkProcessor) [INFO-org.apache.flume.sink.hdfs.BucketWriter.open (BucketWriter.java:234)] Creating hdfs://ns1/flume//FlumeData.1480994688831.tmp
2016-12-06 11 org.apache.flume.sink.hdfs.HDFSEventSink.process 24 org.apache.flume.sink.hdfs.HDFSEventSink.process 49190 (SinkRunner-PollingRunner-DefaultSinkProcessor) [ERROR-org.apache.flume.sink.hdfs.HDFSEventSink.process (HDFSEventSink.java:459)] process failed
Java.lang.NoClassDefFoundError: org/apache/hadoop/util/PlatformName
At org.apache.hadoop.security.UserGroupInformation.getOSLoginModuleName (UserGroupInformation.java:366)
At org.apache.hadoop.security.UserGroupInformation. (UserGroupInformation.java:411)
At org.apache.hadoop.fs.FileSystem$Cache$Key. (FileSystem.java:2828)
At org.apache.hadoop.fs.FileSystem$Cache$Key. (FileSystem.java:2818)
At org.apache.hadoop.fs.FileSystem$Cache.get (FileSystem.java:2684)
At org.apache.hadoop.fs.FileSystem.get (FileSystem.java:373)
At org.apache.hadoop.fs.Path.getFileSystem (Path.java:295)
At org.apache.flume.sink.hdfs.BucketWriter$1.call (BucketWriter.java:243)
At org.apache.flume.sink.hdfs.BucketWriter$1.call (BucketWriter.java:235)
At org.apache.flume.sink.hdfs.BucketWriter$9 $1.run (BucketWriter.java:679)
At org.apache.flume.auth.SimpleAuthenticator.execute (SimpleAuthenticator.java:50)
At org.apache.flume.sink.hdfs.BucketWriter$9.call (BucketWriter.java:676)
At java.util.concurrent.FutureTask.run (FutureTask.java:266)
At java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1142)
At java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:617)
At java.lang.Thread.run (Thread.java:745)
Caused by: java.lang.ClassNotFoundException: org.apache.hadoop.util.PlatformName
At java.net.URLClassLoader.findClass (URLClassLoader.java:381)
At java.lang.ClassLoader.loadClass (ClassLoader.java:424)
At sun.misc.Launcher$AppClassLoader.loadClass (Launcher.java:331)
At java.lang.ClassLoader.loadClass (ClassLoader.java:357)
... 16 more
Resolve:
1,cd / usr/local/hadoop/hadoop/share/hadoop/common/
Cp hadoop-common-2.7.3.jar
2, cd / usr/local/hadoop/hadoop/share/hadoop/common/lib
Hadoop-auth-2.7.3.jar
Just copy the jar package under the lib directory to the lib directory of the flume client.
But there will be a lot of errors, so lazy people copy all the jar packages under lib to lib on the flume side.
Reason: because flume writes data to hdfs, it needs to rely on some hdfs packages
Start:
Flume-ng agent-c / usr/local/ELK/apache-flume/conf/-f / usr/local/ELK/apache-flume/conf/flume_hdfs.conf-Dflume.root.logger=INFO,console-n agent1
Error 2:
2016-12-06 11 org.apache.flume.sink.hdfs.BucketWriter.open 36V 52791 (SinkRunner-PollingRunner-DefaultSinkProcessor) [INFO-org.apache.flume.sink.hdfs.BucketWriter.open (BucketWriter.java:234)] Creating hdfs://ns1/flume//FlumeData.1480995177465.tmp
2016-12-06 11 org.apache.flume.sink.hdfs.HDFSEventSink.process 36V 52793 (SinkRunner-PollingRunner-DefaultSinkProcessor) [WARN-org.apache.flume.sink.hdfs.HDFSEventSink.process (HDFSEventSink.java:455)] HDFS IO error
Java.io.IOException: No FileSystem for scheme: hdfs
At org.apache.hadoop.fs.FileSystem.getFileSystemClass (FileSystem.java:2660)
At org.apache.hadoop.fs.FileSystem.createFileSystem (FileSystem.java:2667)
At org.apache.hadoop.fs.FileSystem.access$200 (FileSystem.java:94)
At org.apache.hadoop.fs.FileSystem$Cache.getInternal (FileSystem.java:2703)
At org.apache.hadoop.fs.FileSystem$Cache.get (FileSystem.java:2685)
At org.apache.hadoop.fs.FileSystem.get (FileSystem.java:373)
At org.apache.hadoop.fs.Path.getFileSystem (Path.java:295)
At org.apache.flume.sink.hdfs.BucketWriter$1.call (BucketWriter.java:243)
At org.apache.flume.sink.hdfs.BucketWriter$1.call (BucketWriter.java:235)
At org.apache.flume.sink.hdfs.BucketWriter$9 $1.run (BucketWriter.java:679)
At org.apache.flume.auth.SimpleAuthenticator.execute (SimpleAuthenticator.java:50)
At org.apache.flume.sink.hdfs.BucketWriter$9.call (BucketWriter.java:676)
At java.util.concurrent.FutureTask.run (FutureTask.java:266)
At java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1142)
At java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:617)
At java.lang.Thread.run (Thread.java:745)
2016-12-06 11 org.apache.flume.sink.hdfs.BucketWriter.open 36V 57798 (SinkRunner-PollingRunner-DefaultSinkProcessor) [INFO-org.apache.flume.sink.hdfs.BucketWriter.open (BucketWriter.java:234)] Creating hdfs://ns1/flume//FlumeData.1480995177466.tmp
2016-12-06 11 org.apache.flume.sink.hdfs.HDFSEventSink.process 36V 57799 (SinkRunner-PollingRunner-DefaultSinkProcessor) [WARN-org.apache.flume.sink.hdfs.HDFSEventSink.process (HDFSEventSink.java:455)] HDFS IO error
Java.io.IOException: No FileSystem for scheme: hdfs
Analysis. The ns1 of hadoop is not recognized by flume at this time.
Solution:
Cd / usr/local/hadoop/hadoop/etc/hadoop
Copy core-site.xml hdfs-site.xml to conf on the flume side
The machine that binds the Hadoop machine
Vim / etc/hosts
172.16.9.250 hadoop1
172.16.9.252 hadoop2
172.16.9.253 hadoop3
There is still one hadoop-hdfs-2.7.3.jar missing at this time.
Download address:
Https://www.versioneye.com/java/org.apache.hadoop:hadoop-hdfs/2.7.3
Upload to the flume lib directory
Start successfully again
Flume-ng agent-c / usr/local/ELK/apache-flume/conf/-f / usr/local/ELK/apache-flume/conf/flume_hdfs.conf-Dflume.root.logger=INFO,console-n agent1
Info: Sourcing environment configuration script / usr/local/ELK/apache-flume/conf/flume-env.sh
Info: Including Hive libraries found via () for Hive access
+ exec / soft/jdk1.8.0_101/bin/java-Xmx20m-Dflume.root.logger=INFO,console-cp'/ usr/local/ELK/apache-flume/conf:/usr/local/ELK/apache-flume/lib/*:/usr/local/ELK/apache-flume:/lib/*'-Djava.library.path= org.apache.flume.node.Application-f / usr/local/ELK/apache-flume/conf/flume_hdfs.conf-n agent1
SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/usr/local/ELK/apache-flume/lib/slf4j-log4j12-1.6.1.jar _ r _ r]
SLF4J: Found binding in [jar:file:/usr/local/ELK/apache-flume/lib/slf4j-log4j12-1.7.10.jarbank]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: Actual binding is of type [org.slf4j.impl.Log4jLoggerFactory]
2016-12-06 13 org.apache.flume.node.PollingPropertiesFileConfigurationProvider.start 3515 05379 (lifecycleSupervisor-1-0) [INFO-org.apache.flume.node.PollingPropertiesFileConfigurationProvider.start (PollingPropertiesFileConfigurationProvider.java:61)] Configuration provider starting
2016-12-06 13 org.apache.flume.node.PollingPropertiesFileConfigurationProvider$FileWatcherRunnable.run 35 conf-file-poller-0 05384 (conf-file-poller-0) [INFO-org.apache.flume.node.PollingPropertiesFileConfigurationProvider$FileWatcherRunnable.run (PollingPropertiesFileConfigurationProvider.java:133)] Reloading configuration file:/usr/local/ELK/apache-flume/conf/flume_hdfs.conf
2016-12-06 13 org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty 35V 05391 (conf-file-poller-0) [INFO-org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty (FlumeConfiguration.java:1017)] Processing:log-sink1
2016-12-06 13 org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty 35V 05391 (conf-file-poller-0) [INFO-org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty (FlumeConfiguration.java:1017)] Processing:log-sink1
2016-12-06 13 org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty 3515 05392 (conf-file-poller-0) [INFO-org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty (FlumeConfiguration.java:1017)] Processing:log-sink1
2016-12-06 13 org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty 3515 05392 (conf-file-poller-0) [INFO-org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty (FlumeConfiguration.java:1017)] Processing:log-sink1
2016-12-06 13 org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty 35V 05392 (conf-file-poller-0) [INFO-org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty (FlumeConfiguration.java:931)] Added sinks: log-sink1 Agent: agent1
2016-12-06 13 org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty 3515 05392 (conf-file-poller-0) [INFO-org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty (FlumeConfiguration.java:1017)] Processing:log-sink1
2016-12-06 13 org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty 3515 05392 (conf-file-poller-0) [INFO-org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty (FlumeConfiguration.java:1017)] Processing:log-sink1
2016-12-06 13 org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty 3515 05392 (conf-file-poller-0) [INFO-org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty (FlumeConfiguration.java:1017)] Processing:log-sink1
2016-12-06 13 org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty 3515 05392 (conf-file-poller-0) [INFO-org.apache.flume.conf.FlumeConfiguration$AgentConfiguration.addProperty (FlumeConfiguration.java:1017)] Processing:log-sink1
2016-12-06 13 org.apache.flume.conf.FlumeConfiguration.validateConfiguration 35V 05403 (conf-file-poller-0) [INFO-org.apache.flume.conf.FlumeConfiguration.validateConfiguration (FlumeConfiguration.java:141)] Post-validation flume configuration contains configuration for agents: [agent1]
2016-12-06 13 org.apache.flume.node.AbstractConfigurationProvider.loadChannels 35 conf-file-poller-0 05403 (conf-file-poller-0) [INFO-org.apache.flume.node.AbstractConfigurationProvider.loadChannels (AbstractConfigurationProvider.java:145)] Creating channels
2016-12-06 13 org.apache.flume.channel.DefaultChannelFactory.create 35 conf-file-poller-0 05410 (conf-file-poller-0) [INFO-org.apache.flume.channel.DefaultChannelFactory.create (DefaultChannelFactory.java:42)] Creating instance of channel ch2 type memory
2016-12-06 13 org.apache.flume.node.AbstractConfigurationProvider.loadChannels 35V 05417 (conf-file-poller-0) [INFO-org.apache.flume.node.AbstractConfigurationProvider.loadChannels (AbstractConfigurationProvider.java:200)] Created channel ch2
2016-12-06 13 org.apache.flume.source.DefaultSourceFactory.create 35V 05418 (conf-file-poller-0) [INFO-org.apache.flume.source.DefaultSourceFactory.create (DefaultSourceFactory.java:41)] Creating instance of source avro-source1, type exec
2016-12-06 13 org.apache.flume.sink.DefaultSinkFactory.create 35 conf-file-poller-0 (conf-file-poller-0) [INFO-org.apache.flume.sink.DefaultSinkFactory.create (DefaultSinkFactory.java:42)] Creating instance of sink: log-sink1, type: hdfs
2016-12-06 13 org.apache.flume.node.AbstractConfigurationProvider.getConfiguration 35V 05465 (conf-file-poller-0) [INFO-org.apache.flume.node.AbstractConfigurationProvider.getConfiguration (AbstractConfigurationProvider.java:114)] Channel ch2 connected to [avro-source1, log-sink1]
2016-12-06 13 org.apache.flume.node.Application.startAllComponents 35 conf-file-poller-0 (conf-file-poller-0) [INFO-org.apache.flume.node.Application.startAllComponents (Application.java:138)] Starting new configuration: {sourceRunners: {avro-source1=EventDrivenSourceRunner: {source:org.apache.flume.source.ExecSource {name:avro-source1 State:IDLE}}} sinkRunners: {log-sink1=SinkRunner: {policy:org.apache.flume.sink.DefaultSinkProcessor@17517996 counterGroup: {name:null counters: {}}} channels: {ch2=org.apache.flume.channel.MemoryChannel {name: ch2}}}
2016-12-06 13 org.apache.flume.node.Application.startAllComponents 35V 05472 (conf-file-poller-0) [INFO-org.apache.flume.node.Application.startAllComponents (Application.java:145)] Starting Channel ch2
2016-12-06 13 lifecycleSupervisor-1 35 lifecycleSupervisor-1-0) [INFO-org.apache.flume.instrumentation.MonitoredCounterGroup.register (MonitoredCounterGroup.java:120)] Monitored counter group for type: CHANNEL, name: ch2: Successfully registered new MBean.
2016-12-06 13 lifecycleSupervisor-1 35 lifecycleSupervisor-1-0) [INFO-org.apache.flume.instrumentation.MonitoredCounterGroup.start (MonitoredCounterGroup.java:96)] Component type: CHANNEL, name: ch2 started
2016-12-06 13 org.apache.flume.node.Application.startAllComponents 3515 05536 (conf-file-poller-0) [INFO-org.apache.flume.node.Application.startAllComponents (Application.java:173)] Starting Sink log-sink1
2016-12-06 13 org.apache.flume.instrumentation.MonitoredCounterGroup.register 35V 05540 (lifecycleSupervisor-1-1) [INFO-org.apache.flume.instrumentation.MonitoredCounterGroup.register (MonitoredCounterGroup.java:120)] Monitored counter group for type: SINK, name: log-sink1: Successfully registered new MBean.
2016-12-06 13 org.apache.flume.instrumentation.MonitoredCounterGroup.start 35 lifecycleSupervisor-1 05540 (lifecycleSupervisor-1-1) [INFO-org.apache.flume.instrumentation.MonitoredCounterGroup.start (MonitoredCounterGroup.java:96)] Component type: SINK, name: log-sink1 started
2016-12-06 13 org.apache.flume.node.Application.startAllComponents 3515 05540 (conf-file-poller-0) [INFO-org.apache.flume.node.Application.startAllComponents (Application.java:184)] Starting Source avro-source1
2016-12-06 13 org.apache.flume.source.ExecSource.start 35V 05541 (lifecycleSupervisor-1-0) [INFO-org.apache.flume.source.ExecSource.start (ExecSource.java:169)] Exec source starting with command:tail-n + 0-F / opt/logs/appcenter.log
2016-12-06 13 org.apache.flume.instrumentation.MonitoredCounterGroup.register 35V 05543 (lifecycleSupervisor-1-0) [INFO-org.apache.flume.instrumentation.MonitoredCounterGroup.register (MonitoredCounterGroup.java:120)] Monitored counter group for type: SOURCE, name: avro-source1: Successfully registered new MBean.
2016-12-06 13 org.apache.flume.instrumentation.MonitoredCounterGroup.start 35V 05543 (lifecycleSupervisor-1-0) [INFO-org.apache.flume.instrumentation.MonitoredCounterGroup.start (MonitoredCounterGroup.java:96)] Component type: SOURCE, name: avro-source1 started
2016-12-06 13 org.apache.flume.sink.hdfs.HDFSDataStream.configure 35V 05934 (SinkRunner-PollingRunner-DefaultSinkProcessor) [INFO-org.apache.flume.sink.hdfs.HDFSDataStream.configure (HDFSDataStream.java:58)] Serializer = TEXT, UseRawLocalFileSystem = false
2016-12-06 13 org.apache.flume.sink.hdfs.BucketWriter.open 35V 06279 (SinkRunner-PollingRunner-DefaultSinkProcessor) [INFO-org.apache.flume.sink.hdfs.BucketWriter.open (BucketWriter.java:234)] Creating hdfs://ns1/flume/161206/FlumeData.1481002505934.tmp
2016-12-06 13 org.apache.hadoop.util.NativeCodeLoader 35V 06586 (hdfs-log-sink1-call-runner-0) [WARN-org.apache.hadoop.util.NativeCodeLoader. (NativeCodeLoader.java:62)] Unable to load native-hadoop library for your platform... Using builtin-java classes where applicable
2016-12-06 13 org.apache.flume.sink.hdfs.BucketWriter.close 36R 07615 (hdfs-log-sink1-roll-timer-0) [INFO-org.apache.flume.sink.hdfs.BucketWriter.close (BucketWriter.java:363)] Closing hdfs://ns1/flume/161206/FlumeData.1481002505934.tmp
2016-12-06 13 org.apache.flume.sink.hdfs.BucketWriter$8.call 3615 07710 (hdfs-log-sink1-call-runner-7) [INFO-org.apache.flume.sink.hdfs.BucketWriter$8.call (BucketWriter.java:629)] Renaming hdfs://ns1/flume/161206/FlumeData.1481002505934.tmp to hdfs://ns1/flume/161206/FlumeData.1481002505934
2016-12-06 13 org.apache.flume.sink.hdfs.HDFSEventSink$1.run 3615 07760 (hdfs-log-sink1-roll-timer-0) [INFO-org.apache.flume.sink.hdfs.HDFSEventSink$1.run (HDFSEventSink.java:394)] Writer callback called.