springboot zinpin+logback+kafka+logstash+es业务日志收集

logback-spring.xml业务日子配置格式%d{yyyy-MM-dd HH:mm:ss.SSS} [${springAppName:-},%X{X-B3-TraceId:-},%X{X-B3-SpanId:-},%X{X-Span-Export:-}] [%thread] %-5level %logger{36} - %msg%n

logstash解析if [type] == "eticket" {
    grok {
        match => {
            "message" => "%{TIMESTAMP_ISO8601:access_time}\ \[%{DATA:server_name}\,%{DATA:trace_id}\,%{DATA:span_id}\,%{DATA:flag}\]\ \[%{DATA:thread_id}\]\ %{DATA:level}\ %{GREEDYDATA:data_message}"
        }
    }
    grok {
        match => {
            "message" => "%{YEAR:ac_year}-%{MONTHNUM:ac_month}-%{MONTHDAY:ac_day}%{DATA:ac_other}"
        }}
    date{
       match => ["access_time","yyyy-MM-dd HH:mm:ss.SSS"]
       target => "order_time"
    }
    mutate {
        add_field => {
          "[@metadata][topic]" => "%{[type]}"
          "[@metadata][index]" => "%{[type]}_%{ac_year}%{ac_month}%{ac_day}"
        }
        remove_field => ["message","offset","@timestamp","prospector","source","tags","input","beat","fields", "@version", "path", "host", "ac_year", "ac_month", "ac_other","ac_day","type","topic"]
    }
  }