【笔记】VictoriaLogs 单机版的测试

作者:张富春(ahfuzhang)，转载时请注明作者和引用链接，谢谢！

• cnblogs博客
• zhihu
• Github
• 公众号:一本正经的瞎扯
  

---

用 docker 启动服务

docker run -it --rm --name vlogs \
	  --cpus=1 -m=512m \
	  -e GOMAXPROCS=1 \
	  -v ~/Downloads/temp/2025/VictoriaLogs/:/data/ \
	  -p 9428:9428 \
	  victoriametrics/victoria-logs:v1.38.0 \
	  -storageDataPath=/data/ \
     -retentionPeriod=7d

浏览器查看 web ui

http://127.0.0.1:9428/select/vmui/

写入数据

jsonline 格式

echo '{"_time":"","_msg":"this is log body 8","a":"stream field a","b":"stream field b","c":"stream field c","other_tag":"xxxx"}
' | curl -X POST -H 'Content-Type: application/stream+json' --data-binary @- \
 "http://127.0.0.1:9428/insert/jsonline?_time_field=_time&_msg_field=_msg&_stream_fields=a,b,c&ignore_fields=&decolorize_fields=&AccountID=0&ProjectID=0&debug=false&extra_fields=" -v

elasticsearch 格式

echo '{"create": {"_index": "your_index_name", "_id": "optional_document_id"}}
{"_time":"","_msg":"this is log body es 1","a":"stream field a","b":"stream field b","c":"stream field c","other_tag":"xxxx"}
' | curl -X POST -H 'Content-Type: application/stream+json' --data-binary @- \
 "http://127.0.0.1:9428/insert/elasticsearch/_bulk?_time_field=_time&_msg_field=_msg&_stream_fields=a,b,c&ignore_fields=&decolorize_fields=&AccountID=0&ProjectID=0&debug=false&extra_fields=" -v

http api

• http://127.0.0.1:9428/select/logsql/streams?query=* 查询 stream

使用 vector 处理日志

先准备一个 haproxy.log 供程序解析：

{ "time":"06/Nov/2025:04:53:43.692","client_ip":"1.1.1.1","bytes_read":"1119","captured_request_headers":"api.xx.com 2.2.2.2 - -","http_method":"POST","http_request_path":"/api/v2/Spin","http_request_query_string":"?traceId=TQGODM09","http_version":"HTTP/1.1","server_name":"host-190","status_code":"200"}

• vector 的配置文件如下：

[sources.my_logs]
type = "file"
include = ["/data/*.log"]
read_from = "beginning"
#ignore_no_files = false
#close_when_done = true

[transforms.parse]
type = "remap"
inputs = ["my_logs"]
source = '''
. = parse_json!(.message)
'''

[sinks.jsonline_http]
type = "http"
inputs = ["parse"]
uri = "http://host.docker.internal:9428/insert/jsonline?_time_field=_time&_msg_field=_msg&_stream_fields=http_request_path&ignore_fields=&decolorize_fields=&AccountID=0&ProjectID=0&debug=false&extra_fields="
method = "post"
encoding.codec = "json"
request.retry_attempts = 0
request.compression = "zstd"
framing.method = "newline_delimited"

• vector 的启动参数如下：
  • VECTOR_LOG=debug 用于开启 debug 日志
  • --config /data/vector.toml 用于指定配置文件路径。此处一定要指定，否则 vector 会使用默认的 /etc/vector/vector.yaml

docker run -it --rm \
	  --cpus=1 -m=512m \
	  -e VECTOR_LOG=debug \
	  -v ~/Downloads/temp/2025/2025-11-19/:/data/ \
	  timberio/vector:nightly-debian --require-healthy=true \
	    --config /data/vector.toml