文章目录
一、安装ES、Logstash、Kibana
安装步骤略过
docker pull elasticsearch:7.8.0
docker pull logstash:7.8.0
docker pull kibana:7.8.0
由于云服务器配置太低,使用docker启动不起来。(使用本地的虚拟机)
二、配置yml
pom依赖
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.3.3.RELEASE</version>
<relativePath/>
</parent>
<dependency>
<groupId>net.logstash.logback</groupId>
<artifactId>logstash-logback-encoder</artifactId>
<version>5.2</version>
</dependency>
spring:
application:
name: wxpublic
logging:
config: classpath:logback-spring.xml
logstash:
host: 192.168.103.10
三、配置logback_spring.xml日志文件
新建mysqletc/mylog.conf文件
<?xml version="1.0" encoding="UTF-8"?>
<configuration scan="true">
<!--引用默认日志配置-->
<include resource="org/springframework/boot/logging/logback/defaults.xml"/>
<!--使用默认的控制台日志输出实现-->
<include resource="org/springframework/boot/logging/logback/console-appender.xml"/>
<!--应用名称-->
<springProperty scope="context" name="APP_NAME" source="spring.application.name" defaultValue="springBoot"/>
<!--日志文件保存路径-->
<property name="LOG_FILE_PATH" value="${LOG_FILE:-${LOG_PATH:-${LOG_TEMP:-${java.io.tmpdir:-/tmp}}}/logs}"/>
<!--LogStash访问host-->
<springProperty name="LOG_STASH_HOST" scope="context" source="logstash.host" defaultValue="192.168.103.10"/>
<!--DEBUG日志输出到LogStash-->
<appender name="LOG_STASH_DEBUG" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
<filter class="ch.qos.logback.classic.filter.ThresholdFilter">
<level>DEBUG</level>
</filter>
<destination>${LOG_STASH_HOST}:4560</destination>
<encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
<providers>
<timestamp>
<timeZone>Asia/Shanghai</timeZone>
</timestamp>
<!--自定义日志输出格式-->
<pattern>
<pattern>
{
"project": "wxpublic",
"level": "%level",
"service": "${APP_NAME:-}",
"pid": "${PID:-}",
"thread": "%thread",
"class": "%logger",
"message": "%message",
"stack_trace": "%exception{20}"
}
</pattern>
</pattern>
</providers>
</encoder>
<!--当有多个LogStash服务时,设置访问策略为轮询-->
<!-- <connectionStrategy>-->
<!-- <roundRobin>-->
<!-- <connectionTTL>5 minutes</connectionTTL>-->
<!-- </roundRobin>-->
<!-- </connectionStrategy>-->
</appender>
<!--ERROR日志输出到LogStash-->
<appender name="LOG_STASH_ERROR" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
<filter class="ch.qos.logback.classic.filter.LevelFilter">
<level>ERROR</level>
<onMatch>ACCEPT</onMatch>
<onMismatch>DENY</onMismatch>
</filter>
<destination>${LOG_STASH_HOST}:4561</destination>
<encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
<providers>
<timestamp>
<timeZone>Asia/Shanghai</timeZone>
</timestamp>
<!--自定义日志输出格式-->
<pattern>
<pattern>
{
"project": "wxpublic",
"level": "%level",
"service": "${APP_NAME:-}",
"pid": "${PID:-}",
"thread": "%thread",
"class": "%logger",
"message": "%message",
"stack_trace": "%exception{20}"
}
</pattern>
</pattern>
</providers>
</encoder>
<!--当有多个LogStash服务时,设置访问策略为轮询-->
<!-- <connectionStrategy>-->
<!-- <roundRobin>-->
<!-- <connectionTTL>5 minutes</connectionTTL>-->
<!-- </roundRobin>-->
<!-- </connectionStrategy>-->
</appender>
<root level="INFO">
<appender-ref ref="CONSOLE"/>
<appender-ref ref="LOG_STASH_DEBUG"/>
<appender-ref ref="LOG_STASH_ERROR"/>
</root>
</configuration>
四、配置logstash信息
input {
tcp {
mode => "server"
host => "0.0.0.0"
port => 4560
codec => json_lines
}
tcp {
mode => "server"
host => "0.0.0.0"
port => 4561
codec => json_lines
type => "error"
}
}
output {
elasticsearch {
#ESIP地址与端口
hosts => "192.168.103.10:9200"
#ES索引名称(自己定义的)
index => "mylog"
}
stdout {
#以JSON格式输出
codec => json_lines
}
}
启动测试
启动es
进入bin目录./elasticsearch -d
-d是后台启动(注意切换es用户,root用户无法启动)
启动Logstash
进入bin目录./logstash -f ../mysqletc/wxlog.conf
启动Kibana
./kibana &
,浏览器访问IP+5601(注意切换es用户,root用户无法启动)