---

下载地址

Vector

---

一、配置文件

1.vector

# 数据源：采集本地日志文件
sources:
  app_logs:
    type: file
    include:
      - /var/log/nginx/*.log
    exclude:
      - /var/log/nginx/error.log

transforms:
  # 解析 Nginx 日志
  parse_nginx:
    type: remap
    inputs:
      - app_logs
    source: |
      # 使用正则表达式解析日志行
      parsed = parse_regex!(.message, r'^(?P<client>\S+) - - \[(?P<time_local>[^\]]+)\] "(?P<method>\S+) (?P<request>\S+) (?P<protocol>\S+)" (?P<status>\d+) (?P<body_bytes_sent>\d+) "(?P<http_referer>.*?)" "(?P<http_user_agent>.*?)"$')
      
      # 将解析结果合并到事件中
      . = merge(., parsed)
      
      # 解析 Referer URL
      if exists(.http_referer) && .http_referer != ""  && .http_referer != "-"{
          url_parts, err = parse_url(.http_referer)
          if is_object(url_parts) {
            .referer_host = url_parts.host
            .referer_path = url_parts.path
            .referer_query = url_parts.query
          }
      }

sinks:
  # 将日志发送到 Loki
  loki:
    type: loki
    inputs:
      - parse_nginx
    endpoint: http://172.16.50.65:3100
    encoding:
      codec: json
    labels:
      job: nginx-service
    batch:
      max_events: 1000          # 每批最多包含的事件数（默认1000）
      timeout_secs: 5           # 批量超时时间（秒），增加该值可以减少请求频率
    healthcheck:
      enabled: true
      path: /ready

2.Loki

loki-config.yaml

# 禁用身份验证
auth_enabled: false

# HTTP 服务端口
server:
  http_listen_port: 3100

# 通用配置（统一路径前缀，简化TSDB配置）
common:
  path_prefix: /tmp/loki  # 所有存储路径的前缀
  replication_factor: 1  # 单节点部署，副本数为1
  ring:
    kvstore:
      store: inmemory  # 单节点使用内存KV存储

# 存储配置
storage_config:
  filesystem:
    directory: /tmp/loki/chunks

# 数据存储的策略
schema_config:
  configs:
    - from: 2020-10-24
      store: tsdb
      object_store: filesystem
      schema: v13
      index:
        prefix: index_
        period: 24h

---

二、查询Loki

// 构建 Loki 查询参数
            Instant endTime = Instant.now();
            Instant startTime = endTime.minus(Duration.ofMinutes(30));

            // LogQL 查询语句：查询 nginx-service 的所有日志 并且 包含 referer_path 字段
            String logql = "{job=\"nginx-service\"} |= `referer_path`";

            // 将时间转换为纳秒时间戳
            Long endTimestamp = endTime.getEpochSecond() * 1_000_000_000L + endTime.getNano();
            Long startTimestamp = startTime.getEpochSecond() * 1_000_000_000L + startTime.getNano();

            // 构建请求 URL
            String requestUrl = String.format("%s?query=%s&start=%d&end=%d&limit=%d",
                    "http://172.16.50.65:3100/loki/api/v1/query_range",
                    URLEncoder.encode(logql, StandardCharsets.UTF_8),
                    startTimestamp,
                    endTimestamp,
                    1000
            );

            // 创建 HTTP 客户端并发送请求
            HttpClient client = HttpUtil.createHttpClient();
            HttpRequest request = HttpRequest.newBuilder()
                    .uri(URI.create(requestUrl))
                    .GET()
                    .timeout(Duration.ofSeconds(120))
                    .build();

            HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

参考链接

Grafana Loki API
LOKI配置文件
loki配置文件详解2