1, data collection: ELK building block structure is used to realize data collection, in which Logstash receives multi-source heterogeneous data and sends it to the message queue at the same time for streaming data processing, and ElasticSearch is used for source data storage.

2. Data processing: Flink real-time streaming computing engine is used to realize streaming data processing, subscribe to the message queue sent to the first link Logstash, and obtain multi-source heterogeneous data from the message queue.