简介

VictoriaLogs 是VictoriaMetrics 开源的日志数据库。提供如下关键特性：

• 接受来自日志采集器的日志。参考 data-ingestion。
• 相比 Elasticsearch and Grafana Loki 设置、操作更简单。
• 提供跨所有 log fields 的 full-text查询语言，简单而强大。 参考 LogsQL docs。
• 可以结合传统工具 grep, less, sort, jq等进行分析，参考 command-line 。
• 容量和性能随可用资源（CPU、RAM、磁盘IO、磁盘空间）线性扩展。它在Raspberry PI和具有数百个CPU核心和TB RAM的服务器上都能顺利运行。
• 基于相同硬件可以处理比Elasticsearch和Grafana Loki大30倍的数据量。参考 benchmarks。
• 支持在高基数 log fields （比如 trace_id, user_id and ip）上进行快速 full-text 检索。
• 支持多租户 - 参考 multitenancy。
• 支持无序日志输入，即回填（backfilling）。
• 提供简易 web UI 供日志查询 - 参考 web-ui。

VictoriaLogs截至（20231220）尚处于预览阶段，只建议用于测试。
推荐阅读 FAQ。

部署

下载二进制包

curl -L -O https://github.com/VictoriaMetrics/VictoriaMetrics/releases/download/v0.4.2-victorialogs/victoria-logs-linux-amd64-v0.4.2-victorialogs.tar.gz

mkdir /opt/victoria-logs

解压

tar -C /opt/victoria-logs/ -xzvf victoria-logs-linux-amd64-v0.4.2-victorialogs.tar.gz

解压出来是一个二进制文件 victoria-logs-prod

[root@VM-201-5-centos ~]# ls /opt/victoria-logs/
victoria-logs-prod

启动服务

nohup ./victoria-logs-prod -retentionPeriod=30d -storageDataPath=/lvmdata/victoria-logs-data > vlogs.out 2>&1 &

监控

VictoriaLogs 将内部指标以 Prometheus exposition format 发布于 http://localhost:9428/metrics。建议通过VictoriaMetrics、 vmagent、 Prometheus 设置监控。

VictoriaLogs 将日志输出到 stdout，troubleshooting可以查阅。

升级

VictoriaLogs 支持任意版本升级/降级（& 跨版本），除非有特别说明。建议升级到最新版本。

步骤：

• 向 VictoriaLogs 进程发送 SIGINT 信号，优雅停机。（kill -s signal pid）
• 等待进程停止。
• 启动升级后的软件版本。

轮转

默认，VictoriaLogs存储7天内的日志，时间戳范围 [now-7d，now]，同时删除时间范围外的日志。
-reretionPeriod 参数设置轮转周期，支持1d（一天）到100y（100年）。参考 time-durations。

如下范例，轮转周期 8周 ：

/path/to/victoria-logs -retentionPeriod=8w

VictoriaLogs 将输入的日志存储在每日分区目录中，自动删除轮转周期外的分区目录。

VictoriaLogs 会在 data ingestion 阶段自动删除超出轮转周期的日志。A sample of dropped logs is logged with WARN message in order to simplify troubleshooting. 为了简化故障排除，将使用WARN消息记录丢弃日志的示例。

每次由于时间戳超出轮转周期而丢弃日志时，vl_rows_dropped_total指标会递增。建议在vmalert中设置以下警报规则，以便及时通知：

rate(vl_rows_dropped_total[5m]) > 0

默认，VictoriaLogs不接受未来2天后的日志，即时间戳大于 now+2d 的日志条目。如果有特殊需要，可以通过 futureDetention 设置。，接受从 1d 开始的值。参考 time-durations 。

如下范例，接受未来1年内的日志：

/path/to/victoria-logs -futureRetention=1y

存储

VictoriaLogs 将所有数据存储于目录 - victoria-logs-data。存储路径可以通过 -storageDataPath 设置进行指定。如下范例，数据存储于 /var/lib/victoria-logs:

/path/to/victoria-logs -storageDataPath=/var/lib/victoria-logs

VictoriaLogs 会在启动的时候自动创建 -storageDataPath 目录。

Multitenancy

VictoriaLogs 支持多租户。租户通过 (AccountID, ProjectID) 标识， AccountID and ProjectID 是任意的32位无符号整数。 AccountID and ProjectID 字段可以在 data ingestion and querying 时通过 AccountID and ProjectID 请求头设置。

如果请求头未设置 AccountID and/or ProjectID ，那么使用默认值 0 。

VictoriaLogs 每租户的管理开销很低，因此轻松支持数千租户。

VictoriaLogs 不对租户进行授权。请使用 vmauth or 类似工具授权。

性能测试

https://github.com/VictoriaMetrics/VictoriaMetrics/tree/master/deployment/logs-benchmark

• 对比测试 elasticsearch

  
  elk-grafana-dashboard.png

• 对比测试 loki

  
  loki-grafana-dashboard.png

配置参数

执行 ./victoria-logs-prod --help 查看配置选项

victoria-logs 是一个日志管理和分析服务。

文档 https://docs.victoriametrics.com/VictoriaLogs/

Options	Description
-blockcache.missesBeforeCaching int	将块放入缓存之前的缓存未命中次数。更高的值会减少 indexdb/dataBlocks 缓存大小，但会导致更高的CPU使用率和磁盘读取。（默认值 2） 用于查询大量时间序列查询时 indexdb/dataBlocks 缓存的内存调优。
-cacheExpireDuration duration	缓存过期时间，在该时间段内未被访问的内容将从内存缓存中删除。较低的值会降低内存使用率，但CPU使用率提升。另请参阅 -prevCacheRemovalPercent（默认值为30m0s）
-elasticsearch.version string	向客户端发送的 Elasticsearch 版本信息 (默认 "8.9.0")
-enableTCP6	开启 IPv6。默认，仅开启 IPv4 TCP and UDP 。
-envflag.enable	Whether to enable reading flags from environment variables in addition to the command line. Command line flag values have priority over values from environment vars. Flags are read only from the command line if this flag isn't set. See https://docs.victoriametrics.com/#environment-variables for more details
-envflag.prefix string	Prefix for environment variables if -envflag.enable is set
-filestream.disableFadvise	Whether to disable fadvise() syscall when reading large data files. The fadvise() syscall prevents from eviction of recently accessed data from OS page cache during background merges and backups. In some rare cases it is better to disable the syscall if it uses too much CPU
-flagsAuthKey string	Auth key for /flags endpoint. It must be passed via authKey query arg. It overrides httpAuth.* settings
-fs.disableMmap	Whether to use pread() instead of mmap() for reading data files. By default, mmap() is used for 64-bit arches and pread() is used for 32-bit arches, since they cannot read data files bigger than 2^32 bytes in memory. mmap() is usually faster for reading small data chunks than pread()
-futureRetention value	Log entries with timestamps bigger than now+futureRetention are rejected during data ingestion; see https://docs.victoriametrics.com/VictoriaLogs/#retention The following optional suffixes are supported: s (second), m (minute), h (hour), d (day), w (week), y (year). If suffix isn't set, then the duration is counted in months (default 2d)
-gogc int	GOGC to use. See https://tip.golang.org/doc/gc-guide (default 100)
-http.connTimeout duration	HTTP 连接超时时间。这有助于负载均衡器分配负载。为了防止惊群现象（thundering herd problem），实际超时时间可能会增加10% (默认 2m0s)
-http.disableResponseCompression	禁用HTTP响应的压缩来节约CPU资源。默认开启以节省带宽资源。
-http.header.csp string	设置 http header 中的 'Content-Security-Policy' 内容。
-http.header.frameOptions string	设置 http header 中的 'X-Frame-Options' 内容。
-http.header.hsts string	设置 http header 中的 'Strict-Transport-Security' 内容。
-http.idleConnTimeout duration	空闲连接超时时间(默认 1m0s)。
-http.maxGracefulShutdownDuration duration	The maximum duration for a graceful shutdown of the HTTP server. A highly loaded server may require increased value for a graceful shutdown (default 7s)
-http.pathPrefix string	An optional prefix to add to all the paths handled by http server. For example, if '-http.pathPrefix=/foo/bar' is set, then all the http requests will be handled on '/foo/bar/*' paths. This may be useful for proxied requests. See https://www.robustperception.io/using-external-urls-and-proxies-with-prometheus
-http.shutdownDelay duration	Optional delay before http server shutdown. During this delay, the server returns non-OK responses from /health page, so load balancers can route new requests to other servers
-httpAuth.password string	Password for HTTP server's Basic Auth. The authentication is disabled if -httpAuth.username is empty
-httpAuth.username string	Username for HTTP server's Basic Auth. The authentication is disabled if empty. See also -httpAuth.password
-httpListenAddr string	HTTP 监听地址（默认 ":9428"）
-httpListenAddr.useProxyProtocol	Whether to use proxy protocol for connections accepted at -httpListenAddr . See https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt . With enabled proxy protocol http server cannot serve regular /metrics endpoint. Use -pushmetrics.url for metrics pushing
-inmemoryDataFlushInterval duration	The interval for guaranteed saving of in-memory data to disk. The saved data survives unclean shutdowns such as OOM crash, hardware reset, SIGKILL, etc. Bigger intervals may help increase the lifetime of flash storage with limited write cycles (e.g. Raspberry PI). Smaller intervals increase disk IO load. Minimum supported value is 1s (default 5s)
-insert.maxFieldsPerLine int	The maximum number of log fields per line, which can be read by /insert/* handlers (default 1000)
-insert.maxLineSizeBytes size	The maximum size of a single line, which can be read by /insert/* handlers Supports the following optional suffixes for size values: KB, MB, GB, TB, KiB, MiB, GiB, TiB (default 262144)
-insert.maxQueueDuration duration	The maximum duration to wait in the queue when -maxConcurrentInserts concurrent insert requests are executed (default 1m0s)
-internStringCacheExpireDuration duration	The expiry duration for caches for interned strings. See https://en.wikipedia.org/wiki/String_interning . See also -internStringMaxLen and -internStringDisableCache (default 6m0s)
-internStringDisableCache	Whether to disable caches for interned strings. This may reduce memory usage at the cost of higher CPU usage. See https://en.wikipedia.org/wiki/String_interning . See also -internStringCacheExpireDuration and -internStringMaxLen
-internStringMaxLen int	The maximum length for strings to intern. A lower limit may save memory at the cost of higher CPU usage. See https://en.wikipedia.org/wiki/String_interning . See also -internStringDisableCache and -internStringCacheExpireDuration (default 500)
-logIngestedRows	Whether to log all the ingested log entries; this can be useful for debugging of data ingestion; see https://docs.victoriametrics.com/VictoriaLogs/data-ingestion/ ; see also -logNewStreams
-logNewStreams	Whether to log creation of new streams; this can be useful for debugging of high cardinality issues with log streams; see https://docs.victoriametrics.com/VictoriaLogs/keyConcepts.html#stream-fields ; see also -logIngestedRows
-loggerDisableTimestamps	Whether to disable writing timestamps in logs
-loggerErrorsPerSecondLimit int	Per-second limit on the number of ERROR messages. If more than the given number of errors are emitted per second, the remaining errors are suppressed. Zero values disable the rate limit
-loggerFormat string	Format for logs. Possible values: default, json (default "default")
-loggerJSONFields string	Allows renaming fields in JSON formatted logs. Example: "ts:timestamp,msg:message" renames "ts" to "timestamp" and "msg" to "message". Supported fields: ts, level, caller, msg
-loggerLevel string	Minimum level of errors to log. Possible values: INFO, WARN, ERROR, FATAL, PANIC (default "INFO")
-loggerMaxArgLen int	The maximum length of a single logged argument. Longer arguments are replaced with 'arg_start..arg_end', where 'arg_start' and 'arg_end' is prefix and suffix of the arg with the length not exceeding -loggerMaxArgLen / 2 (default 1000)
-loggerOutput string	Output for the logs. Supported values: stderr, stdout (default "stderr")
-loggerTimezone string	Timezone to use for timestamps in logs. Timezone must be a valid IANA Time Zone. For example: America/New_York, Europe/Berlin, Etc/GMT+3 or Local (default "UTC")
-loggerWarnsPerSecondLimit int	Per-second limit on the number of WARN messages. If more than the given number of warns are emitted per second, then the remaining warns are suppressed. Zero values disable the rate limit
-maxConcurrentInserts int	The maximum number of concurrent insert requests. Default value should work for most cases, since it minimizes the memory usage. The default value can be increased when clients send data over slow networks. See also -insert.maxQueueDuration (default 4)
-memory.allowedBytes size	Allowed size of system memory VictoriaMetrics caches may occupy. This option overrides -memory.allowedPercent if set to a non-zero value. Too low a value may increase the cache miss rate usually resulting in higher CPU and disk IO usage. Too high a value may evict too much data from the OS page cache resulting in higher disk IO usage Supports the following optional suffixes for size values: KB, MB, GB, TB, KiB, MiB, GiB, TiB (default 0)
-memory.allowedPercent float	Allowed percent of system memory VictoriaMetrics caches may occupy. See also -memory.allowedBytes. Too low a value may increase cache miss rate usually resulting in higher CPU and disk IO usage. Too high a value may evict too much data from the OS page cache which will result in higher disk IO usage (default 60)
-metricsAuthKey string	Auth key for /metrics endpoint. It must be passed via authKey query arg. It overrides httpAuth.* settings
-pprofAuthKey string	Auth key for /debug/pprof/* endpoints. It must be passed via authKey query arg. It overrides httpAuth.* settings
-prevCacheRemovalPercent float	Items in the previous caches are removed when the percent of requests it serves becomes lower than this value. Higher values reduce memory usage at the cost of higher CPU usage. See also -cacheExpireDuration (default 0.1)
-pushmetrics.extraLabel array	Optional labels to add to metrics pushed to -pushmetrics.url . For example, -pushmetrics.extraLabel='instance="foo"' adds instance="foo" label to all the metrics pushed to -pushmetrics.url Supports an array of values separated by comma or specified via multiple flags.
-pushmetrics.interval duration	Interval for pushing metrics to -pushmetrics.url (default 10s)
-pushmetrics.url array	Optional URL to push metrics exposed at /metrics page. See https://docs.victoriametrics.com/#push-metrics . By default, metrics exposed at /metrics page aren't pushed to any remote storage Supports an array of values separated by comma or specified via multiple flags.
-retentionPeriod value	Log entries with timestamps older than now-retentionPeriod are automatically deleted; log entries with timestamps outside the retention are also rejected during data ingestion; the minimum supported retention is 1d (one day); see https://docs.victoriametrics.com/VictoriaLogs/#retention The following optional suffixes are supported: s (second), m (minute), h (hour), d (day), w (week), y (year). If suffix isn't set, then the duration is counted in months (default 7d)
-search.maxConcurrentRequests int	The maximum number of concurrent search requests. It shouldn't be high, since a single request can saturate all the CPU cores, while many concurrently executed requests may require high amounts of memory. See also -search.maxQueueDuration (default 4)
-search.maxQueryDuration duration	The maximum duration for query execution (default 30s)
-search.maxQueueDuration duration	The maximum time the search request waits for execution when -search.maxConcurrentRequests limit is reached; see also -search.maxQueryDuration (default 10s)
-select.maxSortBufferSize size	Query results from /select/logsql/query are automatically sorted by _time if their summary size doesn't exceed this value; otherwise, query results are streamed in the response without sorting; too big value for this flag may result in high memory usage since the sorting is performed in memory Supports the following optional suffixes for size values: KB, MB, GB, TB, KiB, MiB, GiB, TiB (default 1048576)
-storage.minFreeDiskSpaceBytes size	The minimum free disk space at -storageDataPath after which the storage stops accepting new data Supports the following optional suffixes for size values: KB, MB, GB, TB, KiB, MiB, GiB, TiB (default 10000000)
-storageDataPath string	VictoriaLogs 数据目录，默认 "victoria-logs-data" 。
-tls	开启 TLS。如果开启，那么 -tlsCertFile 和 -tlsKeyFile 也必须同步设置。
-tlsCertFile string	证书路径。推荐 ECDSA 证书，而不是RSA证书，因为RSA证书慢。每秒重复读取，所以支持动态更新。
-tlsCipherSuites array	Optional list of TLS cipher suites for incoming requests over HTTPS if -tls is set. See the list of supported cipher suites at https://pkg.go.dev/crypto/tls#pkg-constants Supports an array of values separated by comma or specified via multiple flags.
-tlsKeyFile string	密钥路径。每秒重复读取，所以支持动态更新。
-tlsMinVersion string	Optional minimum TLS version to use for incoming requests over HTTPS if -tls is set. Supported values: TLS10, TLS11, TLS12, TLS13
-version	显示 VictoriaMetrics 版本