日志分析系统(flume)之数据加密

大数据

在实现flume采集数据并使用kafka传输数据后发现数据是以明文传输的，对于安全性要求较高的系统来说是不可取的，故使用flume可扩展的自定义拦截功能来将数据过滤和加密本文主要讲加密过滤的部分依据实际的需要来增加，拦截器使用maven项目实现。有疑问可以参考上篇日志（此处需要采集初始机制搭建完成） — 日志分析系统(zookeeper+flume+kafka)之实时接收数据

自定义拦截器

1.实现interceptor接口，并实现其方法，接口完全限定名为：org.apache.flume.interceptor.Interceptor;

2.自定义拦截器内部添加静态内部类，实现Builder接口，并实现其方法，接口完全限定名为：Interceptor.Builder

插件开发

maven项目pom.xml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com</groupId>
  <artifactId>yang.interceptor</artifactId>
  <version>0.0.1-SNAPSHOT</version>
  <packaging>jar</packaging>
  <name>yang.interceptor</name>
  <url>http://maven.apache.org</url>
  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
  </properties>
  <dependencies>
   		<dependency>
	        <groupId>org.apache.flume</groupId>
	        <artifactId>flume-ng-sdk</artifactId>
	        <version>1.8.0</version>
	    </dependency>
	    <dependency>
	        <groupId>org.apache.flume</groupId>
	        <artifactId>flume-ng-core</artifactId>
	        <version>1.8.0</version>
	    </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-log4j12</artifactId>
            <version>1.7.25</version>
        </dependency>
        <dependency>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
            <version>1.2.17</version>
        </dependency>        
	    <dependency>
	      <groupId>junit</groupId>
	      <artifactId>junit</artifactId>
	      <version>3.8.1</version>
	      <scope>test</scope>
	    </dependency>
	  </dependencies>	  
	   <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.2</version>
                <configuration>
                    <source>1.8</source>
                    <target>1.8</target>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-dependency-plugin</artifactId>
                <executions>
                    <execution>
                        <id>copy-dependencies</id>
                        <phase>test</phase>
                        <goals>
                            <goal>copy-dependencies</goal>
                        </goals>
                        <configuration>
                            <outputDirectory>
                                target/classes/lib
                            </outputDirectory>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
                <configuration>
                    <archive>
                        <manifest>
                            <addClasspath>true</addClasspath>
                            <mainClass>
                                com.yang.interceptor.CustomInterceptor
                            </mainClass>
                            <classpathPrefix>lib/</classpathPrefix>
                        </manifest>
                        <manifestEntries>
                            <Class-Path>.</Class-Path>
                        </manifestEntries>
                    </archive>
                </configuration>
            </plugin>
        </plugins>
    </build>
</project>

拦截器实现

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
package com.yang.interceptor;
import org.apache.commons.compress.utils.Charsets;
import org.apache.flume.Context;
import org.apache.flume.Event;
import org.apache.flume.interceptor.Interceptor;
import java.util.ArrayList;
import java.util.List;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.yang.interceptor.EncryptUtil;
 
/**
 * 自定义拦截器，实现Interceptor接口，并且实现其抽象方法
 */
public class CustomInterceptor implements Interceptor {
 
    //打印日志，便于测试方法的执行顺序
    private static final Logger logger = LoggerFactory.getLogger(CustomInterceptor.class);
    //自定义拦截器参数，用来接收自定义拦截器flume配置参数
    private static String param = ""; 
    /**
     * 拦截器构造方法，在自定义拦截器静态内部类的build方法中调用，用来创建自定义拦截器对象。
     */
    public CustomInterceptor() {
    	System.out.printf("----------自定义拦截器构造方法执行 \n");
    } 
    /**
     * 该方法用来初始化拦截器，在拦截器的构造方法执行之后执行，也就是创建完拦截器对象之后执行
     */
    @Override
    public void initialize() {
    	System.out.printf("----------自定义拦截器的initialize方法执行 \n");
    } 
    /**
     * 用来处理每一个event对象，该方法不会被系统自动调用，一般在 List<Event> intercept(List<Event> events) 方法内部调用。
     *
     * @param event
     * @return
     */
    @Override
    public Event intercept(Event event) {
    	String eventBody = new String(event.getBody(), Charsets.UTF_8);     	
    	String data = "数据加密失败！";
        try {
			//data = Base64.getEncoder().encodeToString(eventBody.getBytes("utf-8"));
			String key = "bba45bfd5zz64232iec03ad8ef1b6egj";// 自定义密钥
			EncryptUtil des = new EncryptUtil(key, "utf-8");
			data = des.encode(eventBody);
			System.out.println("BASE64加密：" + data+" \n");		
			String decodeStr = des.decode(data);
			System.out.printf("BASE64解密："+decodeStr+" \n");
		} catch (Exception e) {
			System.out.println("BASE64加解密异常  \n");
			//e.printStackTrace();
		}
        event.setBody(data.getBytes());
    	//System.out.printf("----------接收到的自定义拦截器参数值param值为：" + param +" \n");
        /*
        	这里编写event的处理代码
         */
        return event;
    } 
    /**
     * 用来处理一批event对象集合，集合大小与flume启动配置有关，和transactionCapacity大小保持一致。一般直接调用 Event intercept(Event event) 处理每一个event数据。
     *
     * @param events
     * @return
     */
    @Override
    public List<Event> intercept(List<Event> events) { 
    	//System.out.printf("----------intercept(List<Event> events)方法执行  \n"); 
        /*
        	这里编写对于event对象集合的处理代码，一般都是遍历event的对象集合，对于每一个event对象，调用 Event intercept(Event event) 方法，然后根据返回值是否为null，
        	来将其添加到新的集合中。
         */
        List<Event> results = new ArrayList<>();
        Event event;
        for (Event e : events) {
            event = intercept(e);
            if (event != null) {
                results.add(event);
            }
        }
        return results;
    }
    /**
     * 该方法主要用来销毁拦截器对象值执行，一般是一些释放资源的处理
     */
    @Override
    public void close() {
    	System.out.printf("----------自定义拦截器close方法执行  \n");
    } 
    /**
     * 通过该静态内部类来创建自定义对象供flume使用，实现Interceptor.Builder接口，并实现其抽象方法
     */
    public static class Builder implements Interceptor.Builder {
 
        /**
         * 该方法主要用来返回创建的自定义类拦截器对象
         *
         * @return
         */
        @Override
        public Interceptor build() {
        	System.out.printf("----------build方法执行  \n");
            return new CustomInterceptor();
        }
        /**
         * 用来接收flume配置自定义拦截器参数
         *
         * @param context 通过该对象可以获取flume配置自定义拦截器的参数
         */
        @Override
        public void configure(Context context) {
        	System.out.printf("----------configure方法执行  \n");
            /*
            通过调用context对象的getString方法来获取flume配置自定义拦截器的参数，方法参数要和自定义拦截器配置中的参数保持一致+
             */
            param = context.getString("param");
        }
    }
}

加密算法类实现

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
package com.yang.interceptor;
import java.security.Key;
import java.security.spec.AlgorithmParameterSpec;
import java.util.Base64;
import javax.crypto.Cipher;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.DESKeySpec;
import javax.crypto.spec.IvParameterSpec;
import org.apache.commons.lang.StringUtils;

public class EncryptUtil {
	 
	private final byte[] DESIV = new byte[] { 0x12, 0x34, 0x56, 120, (byte) 0x90, (byte) 0xab, (byte) 0xcd, (byte) 0xef };// 向量 
	private AlgorithmParameterSpec iv = null;// 加密算法的参数接口
	private Key key = null;	
	private String charset = "utf-8";	
	/**
	 * 初始化
	 * @param deSkey	密钥
	 * @throws Exception
	 */
	public EncryptUtil(String deSkey, String charset) throws Exception {
		if (StringUtils.isNotBlank(charset)) {
			this.charset = charset;
		}
		DESKeySpec keySpec = new DESKeySpec(deSkey.getBytes(this.charset));// 设置密钥参数
		iv = new IvParameterSpec(DESIV);// 设置向量
		SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("DES");// 获得密钥工厂
		key = keyFactory.generateSecret(keySpec);// 得到密钥对象
	}	
	/**
	 * 加密
	 * @author xhy
	 * @param data
	 * @return
	 * @throws Exception
	 */
	public String encode(String data) throws Exception {
		Cipher enCipher = Cipher.getInstance("DES/CBC/PKCS5Padding");// 得到加密对象Cipher
		enCipher.init(Cipher.ENCRYPT_MODE, key, iv);// 设置工作模式为加密模式，给出密钥和向量
		byte[] pasByte = enCipher.doFinal(data.getBytes("utf-8"));
		return  Base64.getEncoder().encodeToString(pasByte);
	}
	/**
	 * 解密
	 * @author xhy
	 * @param data
	 * @return
	 * @throws Exception
	 */
	public String decode(String data) throws Exception {
		Cipher deCipher = Cipher.getInstance("DES/CBC/PKCS5Padding");
		deCipher.init(Cipher.DECRYPT_MODE, key, iv);
		byte[] pasByte = deCipher.doFinal(Base64.getDecoder().decode(data.getBytes("utf-8")));
		return new String(pasByte, "UTF-8");
	}
}

项目生成jar包

项目生成jar包

  • ide右键点击runAs->Maven Install 生成jar包

插件拷贝至flume的lib内

插件的目录在/usr/local/flume/lib/ ，把项目jar包上传至该目录

flume 配置修改

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
vim ./flume/conf/customInterceptor.conf  

# 配置修改

agent.sources = s1
agent.channels = c1
agent.sinks = k1

# 从指定文件读取数据
agent.sources.s1.type = exec
agent.sources.s1.command = tail -f /home/wwwlogs/access.log
agent.sources.s1.channels = c1

# 拦截器配置
agent.sources.r1.interceptors=i1
agent.sources.r1.interceptors.i1.type=com.yang.interceptor.CustomInterceptor$Builder
agent.sources.r1.interceptors.i1.param=parameter

# 配置传输通道
agent.channels.c1.type = memory
agent.channels.c1.capacity = 10000
agent.channels.c1.transactionCapacity = 100

# 配置kafka接收数据
agent.sinks.k1.type = org.apache.flume.sink.kafka.KafkaSink
agent.sinks.k1.brokerList = 10.1.1.35:9092
agent.sinks.k1.topic = test
agent.sinks.k1.serializer.class = kafka.serializer.StringEncoder
agent.sinks.k1.channel = c1

启动flume程序

/usr/local/flume/bin/flume-ng agent –conf-file /usr/local/flume/conf/customInterceptor.conf -c conf/ –name agent -Dflume.root.logger=DEBUG,console &

结果查看

flume拦截情况

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
----------configure方法执行
----------build方法执行
----------自定义拦截器构造方法执行
----------自定义拦截器的initialize方法执行
BASE64加密：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9v4Wt4t3+wdnIFain8bxydqpeTp/ssHjtOb/Qa8uYfdq8OfTuWJjBqu1GGlR2OOdBpO8dDQH1HhmJIKLXY38fHFjG3Ng71hEnmZVOKD805piPMxUAOHaOF/vboTgO6mZOpmzTtvtU3SIuAyREnwUGBnQXYkOulog1JXkQ6zTPA5bY05U976LdTb3Ydm8soMur9/y3Gza5HRgjSG+9T1xuSmBiE3TZogS9JnpZqI8Ao211GVscpd58VA==

BASE64解密：10.1.3.165 - - [21/May/2019:15:22:32 +0800] "GET / HTTP/1.1" 200 661 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132"
BASE64加密：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9v4Wt4t3+wdlgvih4eOmn4Auj9NraYvfg3+kL8I/6IeU2kwjtWG+DJdrBJAui7oiExzJJsMSzK3G/hnqwra6IxveSg6yfLaXXDk1N/B17gptFzOR31WmIhXZuHZQVPqfUKyEDdi4z7dswkY8pB28iySfsY3JauGesv0mdyO8I5xyLQ/4i6wPOYcPc6KCLuDsUHqUn3iGEyQ0I1UV7FT1DguxKOMUboMWhsgX3hrCJ08jOqA2NE/XBWA==

BASE64解密：10.1.3.165 - - [21/May/2019:15:24:25 +0800] "GET / HTTP/1.1" 200 661 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132"
BASE64加密：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9v4Wt4t3+wdnJoUalBdcEnktMUs04lOnMHpINkvQLeBL9P0KLh2grJ0IOodxu2KQs2/uTJYiq2zgkK1zpWwK30zoeWsPqf9zz5pKPxbEzDBXevVj77MPnm+c5IprcbMir5IRqBO4jwkkMbo8a6mbRdu2O2vd69ZGSyCcnlbxy2cFqzRInIzz9txFamPl0SmhU9enkLN+0tRAKUocYO629fYPws7vGD0GvdgjcJviIYwFjvoKxYNE51Q==

BASE64解密：10.1.3.165 - - [21/May/2019:15:25:15 +0800] "GET / HTTP/1.1" 200 661 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132"
BASE64加密：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9v4Wt4t3+wdnRl3rtSLNBbyZz0H+W2Lt/aVxXqRA9Fuyveq0CF0X/HQ==

BASE64解密：10.1.3.165 - - [21/May/2019:15:26:06 +0800] "-" 408 - "-" "-"
BASE64加密：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9v4Wt4t3+wdnO8GCHnwJjH4u8Z8pBjwJpe0y0EMsxIs6nYtDmetf4mpV8wzOu2RI77ctvkzuB64ANsMAXumMW3JXOdt3WTFvYUTVKKYLJ4bA2CuoD1XSwz4NxOclSMFBEgJedP2lOotRJLGG2/0PymS57et9R2ZzSkyyjec1b8vT0m3GXsojWuAaa09ND8mSuOCZZDUSf8bOasb6REC2CSXm2I2kqGKYCfJerWhI07JBbnTi8Yr/zaAGSL7T1JkoP

BASE64解密：10.1.3.165 - - [21/May/2019:15:27:31 +0800] "GET /doc HTTP/1.1" 200 1598 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132"
BASE64加密：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9v4Wt4t3+wdmsdbmgvrhqkEPnn61bnjEJ0wdqOyiC/9nhSNgFR18zS+jPzse2jyvyMiCOdG8dLNwhhy4jqlg6l8EYkQsl0Y4XJGCyRe6r5gUcHRmWwAbBE8LiGXuodDBgsLQf4GcgGTQLgMWIzNtmU3QWTFuM0fwWnZmxShrUn9xoyhiqK9rFUJzNlnfymx2SQSfOYSfalAHUZeGu/zOeKzLtM3BRFsDBXWobTG8B/Uw/V+biPM5V7b7su+PrPLLz0+H0hoqVbnzPUBlTKtieAwABca+uPzLJ

BASE64解密：10.1.3.165 - - [21/May/2019:15:27:32 +0800] "GET /doc/search HTTP/1.1" 200 1509 "http://10.1.1.35/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132"
BASE64加密：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9v4Wt4t3+wdmsdbmgvrhqkEPnn61bnjEJojvE+HOhjGMIPjMR9xxODr8/TMtSKb3zIsWnTnPAEYB2np/MJlhhVNJ5lmli/2GvOqrcVW6n54rpR6/orUuhqpd+og8eiVyeEpbL6MLowfFG9vQzIaAWb/sVXR2FZ8r6zFoNFE8WZv+17xjdOD9ieyg06RZWUpbFHNEqI7bqh1gpisIb9Y0OfAQ6z7LlBuRQcN2fq4HyAVJ4pM9EL2aCZLNXkuYMKlsRY3f2umKeHGRnht9GAllM+QyS6FuKBzsX

BASE64解密：10.1.3.165 - - [21/May/2019:15:27:32 +0800] "GET /doc/list HTTP/1.1" 200 3784 "http://10.1.1.35/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132"
BASE64加密：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9lr52c+tMYkjxBe7KUB+RIEHTFVPfwo6sqoYMFT/Ejriy+HordFSc2RIcAAW/sIu6MySJs2d4xiM5B6N7srw9PdINmU/MJnXufShEvvO2iFItACR3ViDHswZROxa6OfQ9Sj4sNHeT6YV4oOKRx0HXmp96ZS/lZBtFX38Uwd/A6oTXh3MCOTvOCBDz0niBOJFq2FBQgXKxui5W5YKblO+YLov+oLmfBD3RJtXTw5dCBZNlZTZlGUP86nLORS73EHPF

BASE64解密：10.1.3.165 - - [21/May/2019:15:34:03 +0800] "GET /doc HTTP/1.1" 200 1598 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132"
BASE64加密：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9lr52c+tMYkjxBe7KUB+RIEHTFVPfwo6sjGVqWYyD6XBs4HImlv8tbHepsbLGFcWPcaRLrE9NVHB0Khw2y4jneky/BsrlkrEh2skRonVcIbbI8zjdGXWLJfMeZtMQFgtw8VnzBD/fJq8m3Qgehn3UBFZZ2Nm3rxp446ZmkBl2jq4wpYNyc7QGT7NEl+Vw/t8lM6l3Ydu66AwDRTr5qsefyYpvHwMIM07TGe+vGKd30fbG4sY82uPk+23EUe2zW7QfzlL2ZW469/lAVYbp8MP2xv12ULzQAClT

BASE64解密：10.1.3.165 - - [21/May/2019:15:34:03 +0800] "GET /doc/search HTTP/1.1" 200 1509 "http://10.1.1.35/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132"
BASE64加密：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9lr52c+tMYkjxBe7KUB+RIEHTFVPfwo6s4IzDv8l/hP44ZrBmiQPZN60eCJw0M0cKLSALlRKRg+xyAYCp3vMLBhbUSpUQFwmK5YR6YYsXVc/fmfGXL9whohiznr0B0LpIeEy55VGM5gwq2OOeVtpxNV7YU5Iw8PmlVSDhDr4thJ6KR8xYUqfuot9/TxvBfyz1QvR8FGU8bGuwGv2VFcCAaFhMUellXC6HV0Blv6CLMbYXn+AIqwWrFaU+geNuvF1MN4O3HHNHeea5mmW+6AqT7nVpD0VDw6hI

BASE64解密：10.1.3.165 - - [21/May/2019:15:34:03 +0800] "GET /doc/list HTTP/1.1" 200 3784 "http://10.1.1.35/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132"

接收端接收情况

1
2
3
4
5
6
7
8
9
10
11
12
13
[接收元数据]：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9v4Wt4t3+wdnO8GCHnwJjH4u8Z8pBjwJpe0y0EMsxIs6nYtDmetf4mpV8wzOu2RI77ctvkzuB64ANsMAXumMW3JXOdt3WTFvYUTVKKYLJ4bA2CuoD1XSwz4NxOclSMFBEgJedP2lOotRJLGG2/0PymS57et9R2ZzSkyyjec1b8vT0m3GXsojWuAaa09ND8mSuOCZZDUSf8bOasb6REC2CSXm2I2kqGKYCfJerWhI07JBbnTi8Yr/zaAGSL7T1JkoP
[数据解析 ]  访问的源IP:10.1.3.165 访问时间:21/May/2019:15:27:31 +0800 请求方法+地址:GET /doc HTTP/1.1 HTTP相应状态:200 完全URL:- HTTP请求头信息:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132
[接收元数据]：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9v4Wt4t3+wdmsdbmgvrhqkEPnn61bnjEJ0wdqOyiC/9nhSNgFR18zS+jPzse2jyvyMiCOdG8dLNwhhy4jqlg6l8EYkQsl0Y4XJGCyRe6r5gUcHRmWwAbBE8LiGXuodDBgsLQf4GcgGTQLgMWIzNtmU3QWTFuM0fwWnZmxShrUn9xoyhiqK9rFUJzNlnfymx2SQSfOYSfalAHUZeGu/zOeKzLtM3BRFsDBXWobTG8B/Uw/V+biPM5V7b7su+PrPLLz0+H0hoqVbnzPUBlTKtieAwABca+uPzLJ
[数据解析 ]  访问的源IP:10.1.3.165 访问时间:21/May/2019:15:27:32 +0800 请求方法+地址:GET /doc/search HTTP/1.1 HTTP相应状态:200 完全URL:http://10.1.1.35/doc HTTP请求头信息:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132
[接收元数据]：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9v4Wt4t3+wdmsdbmgvrhqkEPnn61bnjEJojvE+HOhjGMIPjMR9xxODr8/TMtSKb3zIsWnTnPAEYB2np/MJlhhVNJ5lmli/2GvOqrcVW6n54rpR6/orUuhqpd+og8eiVyeEpbL6MLowfFG9vQzIaAWb/sVXR2FZ8r6zFoNFE8WZv+17xjdOD9ieyg06RZWUpbFHNEqI7bqh1gpisIb9Y0OfAQ6z7LlBuRQcN2fq4HyAVJ4pM9EL2aCZLNXkuYMKlsRY3f2umKeHGRnht9GAllM+QyS6FuKBzsX
[数据解析 ]  访问的源IP:10.1.3.165 访问时间:21/May/2019:15:27:32 +0800 请求方法+地址:GET /doc/list HTTP/1.1 HTTP相应状态:200 完全URL:http://10.1.1.35/doc HTTP请求头信息:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132
[接收元数据]：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9lr52c+tMYkjxBe7KUB+RIEHTFVPfwo6sqoYMFT/Ejriy+HordFSc2RIcAAW/sIu6MySJs2d4xiM5B6N7srw9PdINmU/MJnXufShEvvO2iFItACR3ViDHswZROxa6OfQ9Sj4sNHeT6YV4oOKRx0HXmp96ZS/lZBtFX38Uwd/A6oTXh3MCOTvOCBDz0niBOJFq2FBQgXKxui5W5YKblO+YLov+oLmfBD3RJtXTw5dCBZNlZTZlGUP86nLORS73EHPF
[数据解析 ]  访问的源IP:10.1.3.165 访问时间:21/May/2019:15:34:03 +0800 请求方法+地址:GET /doc HTTP/1.1 HTTP相应状态:200 完全URL:- HTTP请求头信息:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132
[接收元数据]：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9lr52c+tMYkjxBe7KUB+RIEHTFVPfwo6sjGVqWYyD6XBs4HImlv8tbHepsbLGFcWPcaRLrE9NVHB0Khw2y4jneky/BsrlkrEh2skRonVcIbbI8zjdGXWLJfMeZtMQFgtw8VnzBD/fJq8m3Qgehn3UBFZZ2Nm3rxp446ZmkBl2jq4wpYNyc7QGT7NEl+Vw/t8lM6l3Ydu66AwDRTr5qsefyYpvHwMIM07TGe+vGKd30fbG4sY82uPk+23EUe2zW7QfzlL2ZW469/lAVYbp8MP2xv12ULzQAClT
[数据解析 ]  访问的源IP:10.1.3.165 访问时间:21/May/2019:15:34:03 +0800 请求方法+地址:GET /doc/search HTTP/1.1 HTTP相应状态:200 完全URL:http://10.1.1.35/doc HTTP请求头信息:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132
[接收元数据]：73zL5Gzes92h0Bo5iFD+UQcTp5VtZFB9lr52c+tMYkjxBe7KUB+RIEHTFVPfwo6s4IzDv8l/hP44ZrBmiQPZN60eCJw0M0cKLSALlRKRg+xyAYCp3vMLBhbUSpUQFwmK5YR6YYsXVc/fmfGXL9whohiznr0B0LpIeEy55VGM5gwq2OOeVtpxNV7YU5Iw8PmlVSDhDr4thJ6KR8xYUqfuot9/TxvBfyz1QvR8FGU8bGuwGv2VFcCAaFhMUellXC6HV0Blv6CLMbYXn+AIqwWrFaU+geNuvF1MN4O3HHNHeea5mmW+6AqT7nVpD0VDw6hI
[数据解析 ]  访问的源IP:10.1.3.165 访问时间:21/May/2019:15:34:03 +0800 请求方法+地址:GET /doc/list HTTP/1.1 HTTP相应状态:200 完全URL:http://10.1.1.35/doc HTTP请求头信息:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/58.0.3135.132
[接收到数据]  累计数 【20】

赏

×

谢谢客官

扫码支持
扫码打赏，你说多少就多少

打开支付宝扫一扫，即可进行扫码打赏哦

本文标题:日志分析系统(flume)之数据加密

文章作者:莫等闲

发布时间:2019年05月21日 - 15时38分

最后更新:2019年05月23日 - 09时34分

原始链接:https://xhyangdali.github.io/2019/05/21/日志分析系统(flume)之数据加密/

许可协议: "署名-非商用-相同方式共享 3.0" 转载请保留原文链接及作者。

文章目录
  1. 1. 自定义拦截器
  2. 2. 插件开发
    1. 2.1. maven项目pom.xml
    2. 2.2. 拦截器实现
    3. 2.3. 加密算法类实现
    4. 2.4. 项目生成jar包
  3. 3. 插件拷贝至flume的lib内
  4. 4. flume 配置修改
  5. 5. 启动flume程序
  6. 6. 结果查看
    1. 6.1. flume拦截情况
    2. 6.2. 接收端接收情况
,