在 Azure Monitor 中使用适用于 Linux 的 Log Analytics 代理收集自定义 JSON 数据源Collecting custom JSON data sources with the Log Analytics agent for Linux in Azure Monitor

备注

从 Microsoft Operations Management Suite (OMS) 过渡到 Azure Monitor 期间,Windows 或 Linux 的 OMS 代理称为 Windows 或 Linux 的 Log Analytics 代理。As part of the ongoing transition from Microsoft Operations Management Suite (OMS) to Azure Monitor, the OMS Agent for Windows or Linux will be referred to as the Log Analytics agent for Windows and Log Analytics agent for Linux.

可以使用适用于 Linux 的 Log Analytics 代理将自定义 JSON 数据源收集到 Azure Monitor 中。Custom JSON data sources can be collected into Azure Monitor using the Log Analytics agent for Linux. 这些自定义数据源可以是返回 JSON 的简单脚本,例如 curlFluentD 的 300 多个插件之一。These custom data sources can be simple scripts returning JSON such as curl or one of FluentD's 300+ plugins. 本文介绍此数据收集所需的配置。This article describes the configuration required for this data collection.

备注

Log Analytics Linux v1.1.0-217+ 代理是自定义 JSON 数据所必需的Log Analytics agent for Linux v1.1.0-217+ is required for Custom JSON Data

配置Configuration

配置输入插件Configure input plugin

要在 Azure Monitor 中收集 JSON 数据,请将 oms.api. 添加到输入插件中 FluentD 标记的起始位置。To collect JSON data in Azure Monitor, add oms.api. to the start of a FluentD tag in an input plugin.

例如,下面是 /etc/opt/microsoft/omsagent/<workspace id>/conf/omsagent.d/ 中一个单独的配置文件 exec-json.confFor example, following is a separate configuration file exec-json.conf in /etc/opt/microsoft/omsagent/<workspace id>/conf/omsagent.d/. 此配置文件使用 FluentD 插件 exec 每隔 30 秒运行一个 curl 命令。This uses the FluentD plugin exec to run a curl command every 30 seconds. 此命令的输出由 JSON 输出插件收集。The output from this command is collected by the JSON output plugin.

<source>
  type exec
  command 'curl localhost/json.output'
  format json
  tag oms.api.httpresponse
  run_interval 30s
</source>

<match oms.api.httpresponse>
  type out_oms_api
  log_level info

  buffer_chunk_limit 5m
  buffer_type file
  buffer_path /var/opt/microsoft/omsagent/<workspace id>/state/out_oms_api_httpresponse*.buffer
  buffer_queue_limit 10
  flush_interval 20s
  retry_limit 10
  retry_wait 30s
</match>

/etc/opt/microsoft/omsagent/<workspace id>/conf/omsagent.d/ 下添加的配置文件需要使用以下命令更改其所有权。The configuration file added under /etc/opt/microsoft/omsagent/<workspace id>/conf/omsagent.d/ will require to have its ownership changed with the following command.

sudo chown omsagent:omiusers /etc/opt/microsoft/omsagent/conf/omsagent.d/exec-json.conf

配置输出插件Configure output plugin

将下面的输出插件配置添加到 /etc/opt/microsoft/omsagent/<workspace id>/conf/omsagent.conf 中的主配置,或者作为单独的配置文件放置在 /etc/opt/microsoft/omsagent/<workspace id>/conf/omsagent.d/Add the following output plugin configuration to the main configuration in /etc/opt/microsoft/omsagent/<workspace id>/conf/omsagent.conf or as a separate configuration file placed in /etc/opt/microsoft/omsagent/<workspace id>/conf/omsagent.d/

<match oms.api.**>
  type out_oms_api
  log_level info

  buffer_chunk_limit 5m
  buffer_type file
  buffer_path /var/opt/microsoft/omsagent/<workspace id>/state/out_oms_api*.buffer
  buffer_queue_limit 10
  flush_interval 20s
  retry_limit 10
  retry_wait 30s
</match>

重新启动 Log Analytics Linux 代理Restart Log Analytics agent for Linux

使用以下命令重启 Log Analytics Linux 代理服务。Restart the Log Analytics agent for Linux service with the following command.

sudo /opt/microsoft/omsagent/bin/service_control restart 

输出Output

数据将以记录类型 <FLUENTD_TAG>_CL 收集到 Azure Monitor 中。The data will be collected in Azure Monitor with a record type of <FLUENTD_TAG>_CL.

例如,Azure Monitor 中具有 tomcat_CL 记录类型的自定义标记 tag oms.api.tomcatFor example, the custom tag tag oms.api.tomcat in Azure Monitor with a record type of tomcat_CL. 可以使用以下日志查询检索此类型的所有记录。You could retrieve all records of this type with the following log query.

Type=tomcat_CL

支持嵌套 JSON 数据源,但基于父字段编制索引。Nested JSON data sources are supported, but are indexed based off of parent field. 例如,下面的 JSON 数据是以 tag_s : "[{ "a":"1", "b":"2" }] 的形式从日志查询返回的。For example, the following JSON data is returned from a log query as tag_s : "[{ "a":"1", "b":"2" }].

{
    "tag": [{
        "a":"1",
        "b":"2"
    }]
}

后续步骤Next steps

  • 了解日志查询以便分析从数据源和解决方案中收集的数据。Learn about log queries to analyze the data collected from data sources and solutions.