log4j2通过TCP写日志ELK

1 ELK版本号：6.2.3

2 启动elasticsearch， http://localhost:9200/

3 启动elasticsearch-head， http://localhost:9100/

4 启动kibana， http://localhost:5601/

5 logstash bin目录 新建文件 logstash_elastic.conf

 D:\Program Files\elasticsearch-6.2.3\logstash-6.2.3\bin\logstash_elastic.conf

tcp 监听端口5544   elasticsearch 服务 9200  index 名称根据时间生成

input {

tcp {

port => 5544

}

}

output {

elasticsearch {

hosts => [ "localhost:9200"]

index =>  "log4j2-%{+YYYY.MM}"

}

}

5  启动 logstash 

logstash -f logstash_elastic.conf

 

 

6 log4j2 的配置文件

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="off" monitorInterval="120">
    <properties>        
        <property name="LOG_HOME">e:/log2s</property>
    </properties>
    <appenders>
        <!-- Console -->
        <Console name="Console" target="SYSTEM_OUT">
            <PatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"/>
        </Console>

        <!-- tcp 传输日志到 logstash -->
        <Socket name="Socket" protocol="TCP" host="localhost" port="5544">
            <JsonLayout compact="true" eventEol="true" />
            <PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %-5level %logger{36} - %ex%msg%n"/>
        </Socket>      

    </appenders>

    <loggers>
        <asyncRoot level="info">
            <appender-ref ref="Socket"/>
            <appender-ref ref="Console"/>   
        </asyncRoot>
    </loggers>
</configuration>

异步日志记录依赖

<!--log4j2 异步依赖-->
<dependency>
   <groupId>com.lmax</groupId>
   <artifactId>disruptor</artifactId>
   <version>3.3.6</version>
</dependency>

7 访问 http://127.0.0.1:8080/elk/log 打印日志

8 通过head插件查看elasticsearch