Promtail报错

level=warn ts=2025-05-07T06:44:22.715765487Z caller=client.go:369 component=client host=local-loki:3100 msg="error sending batch, will retry" status=500 error="server returned HTTP status 500 Internal Server Error (500): rpc error: code = DeadlineExceeded desc = context deadline exceeded"

查看loki 日志

level=info ts=2025-05-07T06:44:11.830518711Z caller=checkpoint.go:615 msg="starting checkpoint"
level=info ts=2025-05-07T06:44:11.830788697Z caller=checkpoint.go:340 msg="attempting checkpoint for" dir=/data/wal/checkpoint.1237659
level=warn ts=2025-05-07T06:44:20.643216928Z caller=logging.go:86 traceID=1f665e71538b4138 orgID=fake msg="POST /loki/api/v1/push (500) 5.012615543s Response: \"rpc error: code = DeadlineExceeded desc = context deadline exceeded\\n\" ws: false; Connection: close; Content-Length: 266310; Content-Type: application/x-protobuf; User-Agent: promtail/2.6.1; "
level=warn ts=2025-05-07T06:44:21.530545119Z caller=logging.go:86 traceID=1e71d2fb0b8fa807 orgID=fake msg="POST /loki/api/v1/push (500) 5.289903404s Response: \"rpc error: code = DeadlineExceeded desc = context deadline exceeded\\n\" ws: false; Connection: close; Content-Length: 217308; Content-Type: application/x-protobuf; User-Agent: promtail/2.6.1; "
level=warn ts=2025-05-07T06:44:22.441075158Z caller=logging.go:86 traceID=646a00c6b84f9eff orgID=fake msg="POST /loki/api/v1/push (500) 5.100367208s Response: \"rpc error: code = DeadlineExceeded desc = context deadline exceeded\\n\" ws: false; Connection: close; Content-Length: 265673; Content-Type: application/x-protobuf; User-Agent: promtail/2.6.1; "
level=warn ts=2025-05-07T06:44:22.448904508Z caller=logging.go:86 traceID=7c39e6b8a70cd408 orgID=fake msg="POST /loki/api/v1/push (500) 5.31823812s Response: \"rpc error: code = DeadlineExceeded desc = context deadline exceeded\\n\" ws: false; Connection: close; Content-Length: 267119; Content-Type: application/x-protobuf; User-Agent: promtail/2.6.1; "
level=info ts=2025-05-07T06:45:04.018620273Z caller=table_manager.go:134 msg="uploading tables"
level=info ts=2025-05-07T06:45:04.018708423Z caller=index_set.go:86 msg="uploading table index_20215"

context deadline exceeded 超出上下文截至时间

这几个报错的时间都在5s，应该是有配置限制

处理方法

参考：https://github.com/grafana/loki/issues/6182#issuecomment-1695993787

# Ingester_client块配置了分配器distributor将如何连接到摄入器ingesters。仅在运行所有组件，分销商distributor或查询querier时都适当。
ingester_client:
  remote_timeout: 10s # 客户端的远程请求超时时间

默认配置

# The remote request timeout on the client side.
# 客户端的远程请求超时。
# CLI flag: -ingester.client.timeout
[remote_timeout: <duration> | default = 5s]

查看Promtail日志，发现存在Per stream rate limit exceeded (limit: 3MB/sec)报错，触发了Loki每个流每秒最大字节速率限制，可能导致数据丢失，查询异常问题出现。

Promtail异常日志

level=warn ts=2025-05-06T03:09:37.961274973Z caller=client.go:369 component=client host=local-loki:3100 msg="error sending batch, will retry" status=429 error="server returned HTTP status 429 Too Many Requests (429): entry with timestamp 2025-05-06 03:09:37.873760873 +0000 UTC ignored, reason: 'Per stream rate limit exceeded (limit: 3MB/sec) while attempting to ingest for stream '{agent=\"promtail\", filename=\"/opt/test_service/logs/info.log\", hostname=\"test-001\", job=\"service_logs\", service=\"test_service\"}' totaling 494791B, consider splitting a stream via additional labels or contact your Loki administrator to see if the limit can be increased' for stream: {agent=\"promtail\", filename=\"/opt/test_service/logs/info.log\", hostname=\"test-001\", job=\"service_logs\", service=\"test_service\"},"
level=warn ts=2025-05-06T03:09:39.610424292Z caller=client.go:369 component=client host=local-loki:3100 msg="error sending batch, will retry" status=429 error="server returned HTTP status 429 Too Many Requests (429): entry with timestamp 2025-05-06 03:09:39.552467567 +0000 UTC ignored, reason: 'Per stream rate limit exceeded (limit: 3MB/sec) while attempting to ingest for stream '{agent=\"promtail\", filename=\"/opt/test_service/logs/info.log\", hostname=\"test-001\", job=\"service_logs\", service=\"test_service\"}' totaling 2404B, consider splitting a stream via additional labels or contact your Loki administrator to see if the limit can be increased' for stream: {agent=\"promtail\", filename=\"/opt/test_service/logs/info.log\", hostname=\"test-001\", job=\"service_logs\", service=\"test_service\"},"

- 阅读剩余部分 -

问题描述

通过Grafana查询Loki数据源中的日志，发现存在指定时间段内，查询数据与实际文件中的日志不符的现象。

排查发现Promtail存在报错日志server returned HTTP status 429 Too Many Requests (429): Ingestion rate limit exceeded for user fake (limit: 41943040 bytes/sec)，超过了Loki配置的速率上限，被限流了。遂进行调整Loki配置，进行处理。

- 阅读剩余部分 -

在kubernetes中部署promtail，收集pod日志，传输到指定loki中

1.创建一个namespace，用于部署日志收集系统相关服务

2.创建rbac，授权

3.创建promtail配置文件configmap

4.部署promtail服务

- 阅读剩余部分 -

通过promtail直接获取docker容器日志

方案

promtail版本需要在 promtail:2.8.3 以上

因为 promtail:2.6.1 存在问题，无法通过配置 docker_sd_config 收集日志，存在以下报错

level=warn ts=2024-10-28T06:26:18.581600589Z caller=target.go:120 target=docker/5be06c2b393cbad92902f0c978f25221a662f68cea170522a8753b27936d36b6 msg="could not transfer logs" written=0 container=5be06c2b393cbad92902f0c978f25221a662f68cea170522a8753b27936d36b6 err="Unrecognized input header: 50"
level=warn ts=2024-10-28T06:26:18.581736775Z caller=target.go:120 target=docker/9751a71b12db7c5c6677c89a7035a71184e6f7c7a9a55a391c1ece92d47a275f msg="could not transfer logs" written=0 container=9751a71b12db7c5c6677c89a7035a71184e6f7c7a9a55a391c1ece92d47a275f err="Unrecognized input header: 50"
level=warn ts=2024-10-28T06:26:18.582212205Z caller=target.go:120 target=docker/682d6b5bef49dc5ca753185e5a69f715d1ffc6da5431701749ceb2e7f9549c1b msg="could not transfer logs" written=0 container=682d6b5bef49dc5ca753185e5a69f715d1ffc6da5431701749ceb2e7f9549c1b err="Unrecognized input header: 50"

- 阅读剩余部分 -