ELB7层秒级监控

前提条件

• 已采集ELB日志，详情请参见ELB接入。
• 日志配置结构化，详情请参见结构化配置。

背景信息

弹性负载均衡（Elastic Load Balance，简称ELB）是将访问流量根据分配策略分发到后端多台服务器的流量分发控制服务。弹性负载均衡可以通过流量分发扩展应用系统对外的服务能力，同时通过消除单点故障提升应用系统的可用性，支持查看和分析对七层负载均衡HTTP和HTTPS进行请求的详细访问日志记录，包括请求时间、客户端IP地址、请求路径和服务器响应等。

分析网站访问情况

1. 登录云日志服务控制台，在左侧导航栏中选择“日志管理”。
2. 在“日志应用”模块中，单击“ELB日志中心”，选择“进入仪表盘”。
3. 在仪表盘模板下方，选择“ELB仪表盘模板>ELB7层秒级监控”仪表盘，查看图表详情。

ELB7层秒级监控仪表盘中的过滤器说明如下所示：

• 获取所有负载均衡器，所关联的查询分析语句如下所示：

  select distinct(lb_name)

• 获取所有客户端IP，所关联的查询分析语句如下所示：

  select distinct(remote_addr)

• 获取所有后端服务器IP，所关联的查询分析语句如下所示：

  select distinct(upstream_addr)

• 获取所有弹性IP地址，所关联的查询分析语句如下所示：

  select distinct(eip_address) 

ELB7层秒级监控仪表盘中的重要图表说明如下所示：

在搜索框上方选择时间范围，建议选择相对时间30分钟以上的查询时间（即日志上报时间）。由于日志的业务时间（字段名称为time_iso8601）和日志上报时间的差异，在查询时间范围限制下根据业务时间排序的折线图两端的数据不具有参考性。

• 相对时间：表示查询距离当前时间1分钟、5分钟、15分钟等时间区间的日志数据。例如当前时间为19:20:31，设置相对时间1小时，表示查询18:20:31~19:20:31的日志数据。
• 整点时间：表示查询最近整点1分钟、15分钟等时间区间的日志数据。例如当前时间为19:20:31，设置整点时间1小时，表示查询18:00:00~19:00:00的日志数据。
• 自定义：表示查询指定时间范围的日志数据。

• QPS图展示QPS的变化情况，所关联的查询分析语句如下所示：

  select TIME_FORMAT(TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT1S'),'yyyy-MM-dd HH:mm:ss','+08:00') AS _time_ , COUNT(*) as QPS from log group by _time_

• 成功率图展示成功率的变化情况，所关联的查询分析语句如下所示：

  select __time,round(CASE WHEN "成功率" > 0 THEN "成功率" else 0 end,2) as "成功率" from (select TIME_FORMAT(TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S'),'yyyy-MM-dd HH:mm:ss','+08:00') as __time, sum(case when status < 400 then 1 else 0 end) * 100.0 / count(1) as '成功率' from log group by __time)

• 延迟图展示延迟的变化情况，所关联的查询分析语句如下所示：

  select __time,round(CASE WHEN "访问延迟" > 0 THEN "访问延迟" else 0 end,2) as "访问延迟",round(CASE WHEN "Upstream延迟" > 0 THEN "Upstream延迟" else 0 end,2) as "Upstream延迟" from (select TIME_FORMAT(TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S'),'yyyy-MM-dd HH:mm:ss','+08:00') as __time, avg(request_time)* 1000 as '访问延迟',avg(upstream_response_time)* 1000 as 'Upstream延迟' from log group by __time)

• 流量图展示流量的变化情况，所关联的查询分析语句如下所示：

  select TIME_FORMAT(__time, 'yyyy-MM-dd HH:mm:ss', '+08:00') AS __time, round(CASE WHEN "请求流量" > 0 THEN "请求流量" ELSE 0 END, 2) AS "请求流量",round(CASE WHEN "返回body流量" > 0 THEN "返回body流量" ELSE 0 END, 2) AS "返回body流量" from (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'), 'PT5S') as __time,          sum("request_length") / 1024.0 as "请求流量",          sum("body_bytes_sent") / 1024.0 as "返回body流量"        group by          __time      )

• 状态码图展示状态码的变化情况，所关联的查询分析语句如下所示：

  select      TIME_FORMAT(t.t, 'yyyy-MM-dd HH:mm:ss', '+08:00') as "time",      CASE WHEN a."2XX" IS NOT NULL THEN CAST(a."2XX" AS BIGINT)        ELSE 0      END as "2XX",      CASE        WHEN b."3XX" IS NOT NULL THEN CAST(b."3XX" AS BIGINT)        ELSE 0      END as "3XX",      CASE        WHEN c."4XX" IS NOT NULL THEN CAST(c."4XX" AS BIGINT)        ELSE 0      END as "4XX",      CASE        WHEN d."5XX" IS NOT NULL THEN CAST(d."5XX" AS BIGINT)        ELSE 0      END as "5XX",      CASE        WHEN e."其他" IS NOT NULL THEN CAST(e."其他" AS BIGINT)        ELSE 0      END as "其他"    from      (        select          TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),            'PT5S'          ) as t        from          log        group by          t        order by          t asc      ) t      left join (        select          TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),            'PT5S'          ) as t,          CAST(COUNT(1) as VARCHAR) as "2XX"        from          log        WHERE          "status" >= 200          and "status" < 300        group by          t        order by          t asc      ) a on t.t = a.t      left join (        select          TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),            'PT5S'          ) as t,          CAST(COUNT(1) as VARCHAR) as "3XX"        from          log        WHERE          "status" >= 300          and "status" < 400        group by          t        order by          t asc      ) b on t.t = b.t      left join (        select          TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),            'PT5S'          ) as t,          CAST(COUNT(1) as VARCHAR) as "4XX"        from          log        WHERE          "status" >= 400          and "status" < 500        group by          t        order by          t asc      ) c on t.t = c.t      left join (        select          TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),            'PT5S'          ) as t,          CAST(COUNT(1) as VARCHAR) as "5XX"        from          log        WHERE          "status" >= 500          and "status" < 600        group by          t        order by          t asc      ) d on t.t = d.t      left join (        select          TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),            'PT5S'          ) as t,          CAST(COUNT(1) as VARCHAR) as "其他"        from          log        WHERE          "status" < 200          or "status" >= 600        group by          t        order by          t asc      ) e on t.t = e.t

• 后端响应码图展示后端响应码的变化情况，所关联的查询分析语句如下所示：

  select TIME_FORMAT(t.t, 'yyyy-MM-dd HH:mm:ss', '+08:00') as "time",CASE WHEN a."2XX" IS NOT NULL THEN  CAST(a."2XX" AS BIGINT) ELSE 0 END as "2XX",CASE WHEN b."3XX" IS NOT NULL THEN  CAST(b."3XX" AS BIGINT) ELSE 0 END as "3XX",CASE WHEN c."4XX" IS NOT NULL THEN  CAST(c."4XX" AS BIGINT) ELSE 0 END as "4XX",CASE WHEN d."5XX" IS NOT NULL THEN  CAST(d."5XX" AS BIGINT) ELSE 0 END as "5XX",CASE WHEN e."其他" IS NOT NULL THEN  e."其他"  ELSE 0 END as "其他" from (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S') as t from log group by t order by t asc) t left join(select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S') as t , CAST(COUNT(1) as VARCHAR) as "2XX" from log WHERE "upstream_status" >= 200 and "upstream_status" < 300 group by t order by t asc) a on t.t = a.t left join (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S') as t , CAST(COUNT(1) as VARCHAR) as "3XX" from log WHERE "upstream_status" >= 300 and "upstream_status" < 400 group by t order by t asc) b on t.t =b.t left join (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S') as t , CAST(COUNT(1) as VARCHAR) as "4XX" from log WHERE "upstream_status" >= 400 and "upstream_status" < 500 group by t order by t asc) c on t.t =c.t left join (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S') as t , CAST(COUNT(1) as VARCHAR) as "5XX" from log WHERE "upstream_status" >= 500 and "upstream_status" < 600 group by t order by t asc) d on t.t =d.t left join (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S') as t , CAST(COUNT(1) as VARCHAR) as "其他" from log WHERE "upstream_status" < 200 or "upstream_status" >= 600 group by t order by t asc) e on t.t =e.t