日志分析系统部署

部署 4 个代理：collector、parser、alerter 和 dashboard。

角色说明

部署流程

步骤 1： 向用户确认该代理应承担的角色以及所使用的前缀（prefix）。

步骤 2： 安装对应角色所需的技能：

# collector 使用：
clawhub install pilot-stream-data pilot-archive pilot-compress
# parser 使用：
clawhub install pilot-event-filter pilot-task-router pilot-dataset
# alerter 使用：
clawhub install pilot-alert pilot-metrics pilot-cron
# dashboard 使用：
clawhub install pilot-webhook-bridge pilot-slack-bridge pilot-announce

步骤 3： 设置主机名：

pilotctl --json set-hostname -

步骤 4： 编写部署清单文件（manifest）：

mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/log-analytics.json << 'MANIFEST'

MANIFEST

步骤 5： 提示用户与直连通信对端（peers）发起握手（handshake）。

各角色对应的清单模板

collector

{
  "setup": "log-analytics", "setup_name": "Log Analytics",
  "role": "collector", "role_name": "Log Collector",
  "hostname": "-collector",
  "description": "Aggregates logs from servers, containers, and applications. Normalizes formats.",
  "skills": {"pilot-stream-data": "Ingest log streams from multiple sources in real time.", "pilot-archive": "Archive raw logs for retention and forensic analysis.", "pilot-compress": "Compress high-volume log batches before transmission."},
  "peers": [{"role": "parser", "hostname": "-parser", "description": "Receives raw normalized logs"}],
  "data_flows": [{"direction": "send", "peer": "-parser", "port": 1002, "topic": "raw-log", "description": "Raw normalized logs from all sources"}],
  "handshakes_needed": ["-parser"]
}

parser

{
  "setup": "log-analytics", "setup_name": "Log Analytics",
  "role": "parser", "role_name": "Log Parser",
  "hostname": "-parser",
  "description": "Extracts structured fields, parses stack traces, identifies error patterns.",
  "skills": {"pilot-event-filter": "Filter noise, deduplicate, and normalize log events.", "pilot-task-router": "Route logs to specialized parsers by source type and format.", "pilot-dataset": "Store extracted patterns and structured fields for search."},
  "peers": [{"role": "collector", "hostname": "-collector", "description": "Sends raw logs"}, {"role": "alerter", "hostname": "-alerter", "description": "Receives parsed events"}],
  "data_flows": [{"direction": "receive", "peer": "-collector", "port": 1002, "topic": "raw-log", "description": "Raw normalized logs from all sources"}, {"direction": "send", "peer": "-alerter", "port": 1002, "topic": "parsed-event", "description": "Parsed events with structured fields and severity"}],
  "handshakes_needed": ["-collector", "-alerter"]
}

alerter

{
  "setup": "log-analytics", "setup_name": "Log Analytics",
  "role": "alerter", "role_name": "Anomaly Alerter",
  "hostname": "-alerter",
  "description": "Detects log spikes, error rate anomalies, and novel error patterns. Fires alerts.",
  "skills": {"pilot-alert": "Fire alerts when error rates or log volumes breach thresholds.", "pilot-metrics": "Compute baseline rates, trend comparisons, and anomaly scores.", "pilot-cron": "Run scheduled anomaly scans over rolling time windows."},
  "peers": [{"role": "parser", "hostname": "-parser", "description": "Sends parsed events"}, {"role": "dashboard", "hostname": "-dashboard", "description": "Receives anomaly alerts"}],
  "data_flows": [{"direction": "receive", "peer": "-parser", "port": 1002, "topic": "parsed-event", "description": "Parsed events with structured fields"}, {"direction": "send", "peer": "-dashboard", "port": 1002, "topic": "anomaly-alert", "description": "Anomaly alerts with context and baseline comparisons"}],
  "handshakes_needed": ["-parser", "-dashboard"]
}

dashboard

{
  "setup": "log-analytics", "setup_name": "Log Analytics",
  "role": "dashboard", "role_name": "Log Dashboard",
  "hostname": "-dashboard",
  "description": "Provides search, visualization, and drill-down into log data. Generates reports.",
  "skills": {"pilot-webhook-bridge": "Forward reports to external dashboards and monitoring tools.", "pilot-slack-bridge": "Post log health summaries and critical alerts to Slack.", "pilot-announce": "Broadcast periodic log health reports to subscribers."},
  "peers": [{"role": "alerter", "hostname": "-alerter", "description": "Sends anomaly alerts"}],
  "data_flows": [{"direction": "receive", "peer": "-alerter", "port": 1002, "topic": "anomaly-alert", "description": "Anomaly alerts with context and baselines"}, {"direction": "send", "peer": "external", "port": 443, "topic": "log-report", "description": "Log reports to dashboards and Slack channels"}],
  "handshakes_needed": ["-alerter"]
}

数据流向

• collector -> parser ：所有来源的 raw-log 事件（端口 1002）
• parser -> alerter ：含结构化字段与严重等级的 parsed-event（端口 1002）
• alerter -> dashboard ：含上下文与基线对比的 anomaly-alert（端口 1002）
• dashboard -> external ：通过 Webhook 和 Slack 发送的 log-report（端口 443）

握手命令

# collector <-> parser：
pilotctl --json handshake -parser "setup: log-analytics"
pilotctl --json handshake -collector "setup: log-analytics"
# parser <-> alerter：
pilotctl --json handshake -alerter "setup: log-analytics"
pilotctl --json handshake -parser "setup: log-analytics"
# alerter <-> dashboard：
pilotctl --json handshake -dashboard "setup: log-analytics"
pilotctl --json handshake -alerter "setup: log-analytics"

工作流示例

# 在 collector 上 —— 发布原始日志：
pilotctl --json publish -parser raw-log '{"source":"nginx-prod-01","level":"error","message":"upstream timed out"}'
# 在 parser 上 —— 发布解析后的事件：
pilotctl --json publish -alerter parsed-event '{"pattern_id":"NGINX-TIMEOUT-001","level":"error","occurrences_1h":47}'
# 在 alerter 上 —— 发布异常告警：
pilotctl --json publish -dashboard anomaly-alert '{"alert_id":"ALR-7829","type":"error_spike","severity":"critical","current_rate":47,"baseline_rate":3}'
# 在 dashboard 上 —— 发布日志报告：
pilotctl --json publish -dashboard log-report '{"period":"2026-04-09T15:00Z/PT1H","errors":1290,"anomalies_detected":2}'

依赖项

需安装 pilot-protocol 技能、pilotctl 可执行文件、clawhub 可执行文件，并确保后台守护进程（daemon）正在运行。