1.解压flume 到/usr/local/webserver/文件夹下

2.自定义 .config 名字随意起

定义三大组件的名称

ag1.sources = source1
ag1.sinks = sink1
ag1.channels = channel1

配置source组件

ag1.sources.source1.type = spooldir  #行为特点是 只要目录出现新的日志文件 就会读取
ag1.sources.source1.spoolDir = /root/log/
ag1.sources.source1.fileSuffix=.FINISHED

采集数据一行的最大K

ag1.sources.source1.deserializer.maxLineLength=5120 

配置sink组件

ag1.sinks.sink1.type = hdfs
ag1.sinks.sink1.hdfs.path =hdfs://hdp-01:9000/access_log/%y-%m-%d/%H-%M  #文件夹路径
ag1.sinks.sink1.hdfs.filePrefix = app_log   # 前缀
ag1.sinks.sink1.hdfs.fileSuffix = .log   #后缀
ag1.sinks.sink1.hdfs.batchSize= 100  #多少条数据刷一次hdfs
ag1.sinks.sink1.hdfs.fileType = DataStream   #文件类型
ag1.sinks.sink1.hdfs.writeFormat =Text    #写到hdfs上 用Text

## roll：滚动切换：控制写文件的切换规则
ag1.sinks.sink1.hdfs.rollSize = 512000    ## 按文件体积（字节）来切    500K 切切一次
ag1.sinks.sink1.hdfs.rollCount = 1000000  ## 按event条数切   按照多少条记录切一次
ag1.sinks.sink1.hdfs.rollInterval = 60    ## 按时间间隔切换文件   60秒切一次

## 控制生成目录的规则
ag1.sinks.sink1.hdfs.round = true    #是否切换目录
ag1.sinks.sink1.hdfs.roundValue = 10  #10分组切一次
ag1.sinks.sink1.hdfs.roundUnit = minute  #分钟

ag1.sinks.sink1.hdfs.useLocalTimeStamp = true   #使用本地的时间戳取时间

channel组件配置

ag1.channels.channel1.type = memory
ag1.channels.channel1.capacity = 500000   ## event条数 容量 50W条
ag1.channels.channel1.transactionCapacity = 600  ##flume事务控制所需要的缓存容量600条event

绑定source、channel和sink之间的连接

ag1.sources.source1.channels = channel1
ag1.sinks.sink1.channel = channel1

启动 flume

bin/flume-ng agent -c  conf/ -f dir-hdfs.conf -n ag1 -Dflume.root.logger=INFO,console

1. -c 配置文件目录

2. -f 采集文件配置
3. -n ag1
4. -Dflume.root.logger=INFO,console 打印 日志到控制台

配置2

tail-hdfs.conf

tail-hdfs.conf

用tail命令获取数据，下沉到hdfs
启动命令：

bin/flume-ng agent -c conf -f conf/tail-hdfs.conf -n a1

# Name the components on this agent
a1.sources = r1
a1.sinks = k1
a1.channels = c1

# Describe/configure the source
a1.sources.r1.type = exec
a1.sources.r1.command = tail -F /root/app_weichat_login.log

# Describe the sink
agent1.sinks.sink1.type = hdfs
agent1.sinks.sink1.hdfs.path =hdfs://hdp20-01:9000/app_weichat_login_log/%y-%m-%d/%H-%M
agent1.sinks.sink1.hdfs.filePrefix = weichat_log
agent1.sinks.sink1.hdfs.fileSuffix = .dat
agent1.sinks.sink1.hdfs.batchSize= 100
agent1.sinks.sink1.hdfs.fileType = DataStream
agent1.sinks.sink1.hdfs.writeFormat =Text

agent1.sinks.sink1.hdfs.rollSize = 100
agent1.sinks.sink1.hdfs.rollCount = 1000000
agent1.sinks.sink1.hdfs.rollInterval = 60

agent1.sinks.sink1.hdfs.round = true
agent1.sinks.sink1.hdfs.roundValue = 1
agent1.sinks.sink1.hdfs.roundUnit = minute


agent1.sinks.sink1.hdfs.useLocalTimeStamp = true



# Use a channel which buffers events in memory
a1.channels.c1.type = memory
a1.channels.c1.capacity = 1000
a1.channels.c1.transactionCapacity = 100

# Bind the source and sink to the channel
a1.sources.r1.channels = c1
a1.sinks.k1.channel = c1

两个agent 级联
串联 flume 采集数据 发送到另一个 flume上处理数据 最后存到hdfs
发送消息客户端配置
tail-avro.conf
从tail命令获取数据发送到avro端口
另一个节点可配置一个avro源来中继数据，发送外部存储

##################
# Name the components on this agent
a1.sources = r1
a1.sinks = k1
a1.channels = c1

# Describe/configure the source
a1.sources.r1.type = exec
a1.sources.r1.command = tail -F /root/log/access.log


# Describe the sink
a1.sinks.k1.type = avro
a1.sinks.k1.hostname = hdp-05  #目标主机
a1.sinks.k1.port = 4141  #目标端口
a1.sinks.k1.batch-size = 2  #2条发一次



# Use a channel which buffers events in memory
a1.channels.c1.type = memory
a1.channels.c1.capacity = 1000
a1.channels.c1.transactionCapacity = 100

# Bind the source and sink to the channel
a1.sources.r1.channels = c1
a1.sinks.k1.channel = c1

发送消息服务端配置
avro-hdfs.conf
从avro端口接收数据，下沉到hdfs

bin/flume-ng agent -c conf -f conf/avro-m-log.conf -n a1 -Dflume.root.logger=INFO,console

采集配置文件，avro-hdfs.conf

# Name the components on this agent
a1.sources = r1
a1.sinks = k1
a1.channels = c1

# Describe/configure the source
##source中的avro组件是一个接收者服务
a1.sources.r1.type = avro
a1.sources.r1.bind = hdp-05
a1.sources.r1.port = 4141


# Describe the sink
a1.sinks.k1.type = hdfs
a1.sinks.k1.hdfs.path = /flume/taildata/%y-%m-%d/
a1.sinks.k1.hdfs.filePrefix = tail-
a1.sinks.k1.hdfs.round = true
a1.sinks.k1.hdfs.roundValue = 24
a1.sinks.k1.hdfs.roundUnit = hour
a1.sinks.k1.hdfs.rollInterval = 0
a1.sinks.k1.hdfs.rollSize = 0
a1.sinks.k1.hdfs.rollCount = 50
a1.sinks.k1.hdfs.batchSize = 10
a1.sinks.k1.hdfs.useLocalTimeStamp = true
#生成的文件类型，默认是Sequencefile，可用DataStream，则为普通文本
a1.sinks.k1.hdfs.fileType = DataStream

# Use a channel which buffers events in memory
a1.channels.c1.type = memory
a1.channels.c1.capacity = 1000
a1.channels.c1.transactionCapacity = 100

# Bind the source and sink to the channel
a1.sources.r1.channels = c1
a1.sinks.k1.channel = c1

发送数据：

$ bin/flume-ng avro-client -H localhost -p 4141 -F /usr/logs/log.10