flume實(shí)際生產(chǎn)場(chǎng)景分析

需求：A B兩臺(tái)日志服務(wù)器實(shí)時(shí)生產(chǎn)日志主要類(lèi)型為access.log、nginx.log、web.log，現(xiàn)在要求：
把A、B機(jī)器中的access.log、nginx.log、web.log 采集匯總到 C 機(jī)器上然后統(tǒng)一收集到 hdfs中，但是在hdfs中要求的目錄為：
   /source/logs/access/日期/**
   /source/logs/nginx/日期/**
   /source/logs/web/日期/**
場(chǎng)景分析：

規(guī)劃：
hadoop01（web01）：
    source：access.log 、nginx.log、web.log
    channel：memory
    sink：avro
hadoop02（web02）：
    source：access.log 、nginx.log、web.log
    channel：memory
    sink：avro
hadoop03（數(shù)據(jù)收集）：
    source;avro
    channel:memory
    sink:hdfs
配置文件：

#exec_source_avro_sink.properties
#指定各個(gè)核心組件
a1.sources = r1 r2 r3
a1.sinks = k1
a1.channels = c1
#r1
a1.sources.r1.type = exec
a1.sources.r1.command = tail -F /home/hadoop/flume_data/access.log
a1.sources.r1.interceptors = i1
a1.sources.r1.interceptors.i1.type = static
a1.sources.r1.interceptors.i1.key = type
a1.sources.r1.interceptors.i1.value = access

#r2
a1.sources.r2.type = exec
a1.sources.r2.command = tail -F /home/hadoop/flume_data/nginx.log
a1.sources.r2.interceptors = i2
a1.sources.r2.interceptors.i2.type = static
a1.sources.r2.interceptors.i2.key = type
a1.sources.r2.interceptors.i2.value = nginx

#r3
a1.sources.r3.type = exec
a1.sources.r3.command = tail -F /home/hadoop/flume_data/web.log
a1.sources.r3.interceptors = i3
a1.sources.r3.interceptors.i3.type = static
a1.sources.r3.interceptors.i3.key = type
a1.sources.r3.interceptors.i3.value = web

#Describe the sink
a1.sinks.k1.type = avro
a1.sinks.k1.hostname = hadoop03
a1.sinks.k1.port = 41414

#Use a channel which buffers events in memory
a1.channels.c1.type = memory
a1.channels.c1.capacity = 20000
a1.channels.c1.transactionCapacity = 10000

#Bind the source and sink to the channela1.sources.r1.channels = c1
a1.sources.r2.channels = c1
a1.sources.r3.channels = c1
a1.sinks.k1.channel = c1

#avro_source_hdfs_sink.properties
#定義 agent 名， source、channel、sink 的名稱(chēng)
a1.sources = r1
a1.sinks = k1
a1.channels = c1

#定義 source
a1.sources.r1.type = avro
a1.sources.r1.bind = 0.0.0.0
a1.sources.r1.port =41414

#添加時(shí)間攔截器
a1.sources.r1.interceptors = i1
a1.sources.r1.interceptors.i1.type=org.apache.flume.interceptor.TimestampInterceptor$Builder

#定義 channels
a1.channels.c1.type = memory
a1.channels.c1.capacity = 20000
a1.channels.c1.transactionCapacity = 10000

#定義 sink
a1.sinks.k1.type = hdfs
a1.sinks.k1.hdfs.path=hdfs://myha01/source/logs/%{type}/%Y%m%d
a1.sinks.k1.hdfs.filePrefix =events
a1.sinks.k1.hdfs.fileType = DataStream
a1.sinks.k1.hdfs.writeFormat = Text
#時(shí)間類(lèi)型
a1.sinks.k1.hdfs.useLocalTimeStamp = true
#生成的文件不按條數(shù)生成
a1.sinks.k1.hdfs.rollCount = 0
#生成的文件按時(shí)間生成
a1.sinks.k1.hdfs.rollInterval = 30
#生成的文件按大小生成
a1.sinks.k1.hdfs.rollSize = 10485760
#批量寫(xiě)入 hdfs 的個(gè)數(shù)
a1.sinks.k1.hdfs.batchSize = 20
#flume 操作 hdfs 的線程數(shù)（包括新建，寫(xiě)入等）
a1.sinks.k1.hdfs.threadsPoolSize=10
#操作 hdfs 超時(shí)時(shí)間
a1.sinks.k1.hdfs.callTimeout=30000

#組裝 source、channel、sink
a1.sources.r1.channels = c1
a1.sinks.k1.channel = c1

測(cè)試：

#在hadoop01和 hadoop02上的/home/hadoop/data 有數(shù)據(jù)文件 access.log、nginx.log、 web.log
#先啟動(dòng)hadoop03上的flume：（存儲(chǔ)）
flume-ng agent -c conf -f avro_source_hdfs_sink.properties -name a1 -Dflume.root.logger=DEBUG,console
#然后在啟動(dòng)hadoop01和hadoop02上的命令flume（收集）
flume-ng agent -c conf -f exec_source_avro_sink.properties -name a1 -Dflume.root.logger=DEBUG,console