elk

log4j.properties文件

### set log levels ###
log4j.rootLogger = INFO,logstash
###SocketAppender###
log4j.appender.logstash=org.apache.log4j.net.SocketAppender
log4j.appender.logstash.Port=4567
log4j.appender.logstash.RemoteHost=192.168.2.88
log4j.appender.logstash.ReconnectionDelay=60000
log4j.appender.logstash.LocationInfo=true
log4j.appender.logstash.Threshold = DEBUG
log4j.appender.logstash.layout = org.apache.log4j.PatternLayout
log4j.appender.logstash.layout.ConversionPattern = [hadoop][%p] [%-d{yyyy-MM-dd HH:mm:ss}] %C.%M(%L) | %m%n

log4j_2_es.conf

input {
  log4j {
    type => "log4j"
    port => 4567
  }
}
#output{stdout{codec=>rubydebug}}

output {
  elasticsearch {
    action => "index"
    hosts => ["192.168.2.88:9200","192.168.2.70:9200","192.168.1.77:9200"]
    index => "applog"
   }
 }

注elasticsearch中需先创建好索引和文档

http://192.168.2.88:9200/applog/log4j

查看：

http://192.168.2.88:9200/applog/log4j/_search