Alibaba Cloud Log Service is an all‑in‑one service for log‑type data. Users can leave trivial jobs like data collection, storage computing interconnection, and data index and query to Log Service to focus on the analysis. In September 2017, Log Service upgraded the LogSearch/Analytics, allowing real-time log analysis using query + SQL92 syntax.

Besides the built-in Dashboard, interconnections with DataV, Grafana, Tableua, and Quick are also available to visualize the results analysis. This article demonstrates how to analyze and visualize Nginx logs using Log Service by giving an example of Grafana.

Process structure

Process from log collection to analysis is structured as follows.

Figure 1. Process structure


Procedure

  1. Log data collection.  For detailed procedures, see 5-minute quick start.
  2. Index settings and console query configuration. For detailed procedures, see Overview and Analysis - Nginx access logs or Website Log Analysis Case.
  3. Install the Grafana plug-in to convert real-time query SQL into views.

After completing Step 1 and 2, you can view the raw log on the query page.

This document demonstrates Step 3.

Procedure

  1. Install Grafana
  2. Install the Log Service plug-in
  3. Configure the log data source
  4. Add Dashboard
    1. Configure the template variables
    2. Configure PV and UV
    3. Configure inbound and outbound bandwidth
    4. Percentage of HTTP methods
    5. Percentage of HTTP status codes
    6. Page of top sources
    7. Pages of the maximum latency
    8. Top pages
    9. Top pages of non-200 requests
    10. Average frontend and backend latency
    11. Client statistics
    12. Save and release the dashboard
  5. View the results

1 Install Grafana

For detailed installation steps, see Grafana official document.

To Ubuntu, for example, the installation command is:

wget https://s3-us-west-2.amazonaws.com/grafana-releases/release/grafana_4.5.2_amd64.deb
sudo apt-get install -y adduser libfontconfig
sudo dpkg -i grafana_4.5.2_amd64.deb

To use the pie chart, you must install the pie chart plug-in.  For detailed procedures, see Grafana official document.

The installation command is as follows:

grafana-cli plugins install grafana-piechart-panel

2 install the Log service plug-in

Install the Log Service plug-in Confirm the directory location of Grafana plug-in. The location of Ubuntu plug-in is /var/lib/grafana/plugins/ . Restart the grafana-server after installing the plug-in.

Taking Ubuntu system as an example, run the following command to install the plug-in and restart the grafana-server.
cd /var/lib/grafana/plugins/
git clone https://github.com/aliyun/aliyun-log-grafana-datasource-plugin
service grafana-server restart

3 Configure the log data source

For the deployment in a local machine, the default installation location is Port 3000. Open the Port 3000 in a browser.

  1. Click on Grafana’s logo in the upper left corner and select Data Sources in the pop-up window.
  2. Click Add data source, and use Grafana and Alibaba Cloud Log Service for log visual analysis.
  3. Complete the configuration items for the new data source.

    Each part is configured as follows:

    Configuration item Configuration content
    datasource The name can be customized and the type is LogService.
    Http Setting URL input example: http://dashboard-demo.cn-hangzhou.log.aliyuncs.com The dashboard-demo (project name) and cn-hangzhou.log.aliyuncs.com (endpoint of the project region) must be replaced with your project and region addresses when configuring your data source. You can select Direct or Proxy for Access.
    Http Auth Use the default configuration.
    log service details For detailed configuration of Log Service, enter Project, Logstore, and AccessKey that has the read permission respectively. AccessKey can belong to the primary account or the subaccount.

    Configuration example

    Figure 2. Configuration example


After the configuration is complete, click Add to add DataSource. Next, add Dashboard.

 4 Add Dashboard

Click to open the menu in the upper left corner, select Dashboards and click New.  Add a new Dashboard to the menu in the upper left corner.

4. 1 Configure the template variables

You can configure the template variables in Grafana to show different views in the same view by choosing different variable values.  This document describes the configuration of each time interval and the access of different domain names.

  1. Click the Settings icon at the top of the page, and then click Templating.
  2. On the current page, the configured template variables are displayed. Click New to create a new template. First, configure a time interval.

     The name of the variable is the one you used in the configuration, which is called $myinterval here. You must write $myinterval   in the query condition. Please refer to the following table for configuration.

    Configuration items Configuration content
    Name The variable name, which you can name myinterval.
    Type Please select Interval
    Lable. Please entertime interval
    Internal Options Please enter 1m,10m,30m,1h,6h,12h,1d,7d,14d,30d in Value entry.
  3. Configure a domain name template.

    Generally, multiple domain names can be mounted on one vps. You must view the accesses of different domain names. For the template value, enter *,www.host.com,www.host0.com,www.host1.com  to view all the domain names, or view the accesses of www.host.com , www.host0.com or www.host1.com respectively.

    The domain name template configuration as below.

    Configuration items Configuration content
    Name Variable name, you can name it hostname.
    Type Please select Custom
    Lable Please enter a domain name
    Custom Options Please enter *,www.host.com,www.host0.com,www.host1.com forValue entry.

    After the configuration is complete, the template variables configured appears on the top of the Dashboard page. You can select any value from the drop-down box. For example, the following values can be selected for time interval.

4.2 Configure PV and UV

  1. Click ADD ROW on the left to create a new Row. If a Row already exists, you can select Add Panel in the left pop-up menu.
  2. Grafana supports multiple types of views.  For PV and UV data, create a Graphview.
  3. Click Pannel Title and click Edit in the pop-up window.
  4. In Metrics configuration, select logservice for datasource and enter Query, Y axis, and X axis:
    Figure 3. Configure PV and UV
  5. In the dataSource drop-down box, select the configured: logservice.
    Configuration items Configuration content
    Query 
    $hostname| select approx_distinct(remote_addr) as uv ,count(1) as pv , __time__ -
                      __time__ % $$myinterval as time group by time order by time limit
                    1,000
    The $hostname in the preceding Query is replaced with the domain name selected by the user for actual display. The $$myinterval is replaced with a time interval. Note that the number of $ before myinterval is two and for hostname is one.
    X-Column time
    Y-Column uv,pv

    UV and PV values are displayed with two Y axes due to their large difference. Click the colored line on the left of UV below the icon to decide whether the UV is displayed on the left or the right Y axis:

    Figure 4. Y-axis display


    The default view for the title is Panel  Title.  To modify, open the General tab and enter a new title in the Title configuration item, such as PV&UV.

4.3 Configure inbound and outbound bandwidth

You can add inbound and outbound bandwidth traffic in the same way with 4.2 Configure PV and UV.

The main configuration items are as follows:

Configuration items Configuration content
Query
$hostname | select sum(body_byte_sent) as net_out, sum(request_length) as net_in
              ,__time__ - __time__ % $$myinterval as time group by __time__ - __time__ %
              $$myinterval limit 10000
X-Column Time
Y-Column net_in,net_out

4.4 Percentage of HTTP methods

You can configure the percentage of HTTP methods in the same way with 4.2 Configure PV and UV.

Create a new Row, select  Pie Chart , and enter Query, X axis, and Y axis in the configuration.

The main configuration items are as follows:

Configuration items Configuration content
Query
$hostname | select count(1) as pv ,method group by method
X-Column pie
Y-Column method,pv

4.5 Percentage of HTTP status codes

You can configure the percentage of HTTP status codes in the same way with 4.2 Configure PV and UV.

Create a new Row, and select Pie Chart for the view.

The main configuration items are as follows:

Configuration items Configuration content
Query
$hostname | select count(1) as pv ,status group by status
X-Column pie
Y-Column status,pv

4.6 Page of top sources

You can configure the Page of top sources in the same way with 4.2 Configure PV and UV.

Create a new Row, and select Pie Chart for the view:

The main configuration items are as follows:

Configuration items Configuration content
Query
$hostname | select count(1) as pv , referer group by referer order by pv
            desc
X-Column pie
Y-Column referer,pv

4.7 Pages of the maximum latency

You can configure the pages of the maximum latency in the same way with 4.2 Configure PV and UV.

To show URL and its latency in a table, you must specify the view as Table at the time of creation.

The main configuration items are as follows:

Configuration items Configuration content
Query
$hostname | select url as top_latency_url ,request_time order by request_time desc
              limit 10
X-Column X-Column is left blank
Y-Column top_latency_url,request_time

4.8 Top pages

You can add top pages in the same way with 4.2 Configure PV and UV.

Create a new Table view. Data Source select logservice, query content, X-axis, and y-axis please refer to the following table.

Configuration items Configuration content
Query
$hostname | select count(1) as pv, split_part(url,'?',1) as path group by
              split_part(url,'?',1) order by pv desc limit 20
X-Column X-Column is left blank
Y-Column path,pv

4.9 Top pages of non-200 requests

You can add top pages of non-200 requests in the same way with 4.2 Configure PV and UV.

Create a new Table view. Data Source select logservice, query content, X-axis, and y-axis please refer to the following table.

Configuration items Configuration content
Query
$hostname not status:200| select count(1) as pv , url group by url order by pv
              desc
X-Column X-Column is left blank
Y-Column url,pv

4.10 Average frontend and backend latency

You can add average frontend in the same way with 4.2 Configure PV and UV.

Create a new Graph view: Data Source select logservice, query content, X-axis, and y-axis please refer to the following table.

Configuration items Configuration content
Query
$hostname | select avg(request_time) as response_time, avg(upstream_response_time) as
              upstream_response_time ,__time__ - __time__ % $$myinterval as time group by __time__ -
              __time__ % $$myinterval limit 10000
X-Column time 
Y-Column upstream_response_time,response_time

4.11 Client statistics

You can add client statistics in the same way with 4.2 Configure PV and UV.

Create a new Pie Chart. Data Source select logservice, query content, X-axis, and y-axis please refer to the following table.

Configuration items Configuration content
Query
$hostname | select count(1) as pv, case when regexp_like(http_user_agent , 'okhttp') then 'okhttp' when regexp_like(http_user_agent , 'iPhone') then 'iPhone' when regexp_like(http_user_agent , 'Android') then 'Android' else 'unKnown' end as http_user_agent group by http_user_agent order by pv desc limit 10
X-Column pie
Y-Column http_user_agent,pv

4.12 Save and release the dashboard

Click the Save button at the top of the page to release the Dashboard.

5 View the results

Open the home page of Dashboard to view the results. Demo address: Demo.

At the top of the page, you can choose the time range or time granularity of statistics, or you can choose a different domain name.

Now, the configuration of Dashboard for Nginx access statistics is completed, enabling you to mine valuable information from your views.

Figure 5. Check the result.