Spring Boot2.x与Logstash 整合

1. Logstash 的安装

1.1 下载

https://artifacts.elastic.co/downloads/logstash/logstash-6.2.1.tar.gz

1.2 Logstash 接收JSON日志配置

• 配置文件：进入config, 新建logstash.conf，内容如下：
• 编码器列表： https://blog.csdn.net/weixin_34198881/article/details/88728436

1.2.1 配置一(json_lines方式)

• 配置

# Logstash configuration
# TCP -> Logstash -> Elasticsearch pipeline.
 
input {
  tcp {
    mode => "server"
    host => "172.1.26.173" #尽量使用IP
    port => 8081            #从本地的8081端口取日志
    codec => json_lines     #需要安装logstash-codec-json_lines插件
  }
}
 
output {
  elasticsearch {
    hosts => ["http://172.1.26.173:9200"]  #输出到ElasticSearch
    index => "logstash-%{+YYYY.MM.dd}"
  }
  stdout {                              #若不需要在控制台中输出，此行可以删除
    codec => rubydebug
  }
}

• json_lines 插件安装

[root@ecs-55e5 ~]# cd /usr/share/logstash/
[root@ecs-55e5 logstash]# ls
bin  CONTRIBUTORS  data  Gemfile  Gemfile.lock  lib  LICENSE.txt  logstash-core  logstash-core-plugin-api  modules  NOTICE.TXT  tools  vendor  x-pack
[root@ecs-55e5 logstash]# cd bin
[root@ecs-55e5 bin]# ./logstash-plugin install logstash-codec-json_lines
Validating logstash-codec-json_lines
Installing logstash-codec-json_lines
Installation successful
[root@ecs-55e5 bin]#

1.2.2 配置二(json方式)

• 配置

# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
   tcp {
        port => "5044"
        codec => "json"
    }
}

output {
  elasticsearch {
    action => "index"
    hosts => ["http://127.0.0.1:9200"]
    #index => "logstash-%{+YYYY.MM.dd}"
    index => "%{[appname]}"  #此处index可以从logback.xml中customFields标签中获取appname
  }
  stdout {     #若不需要在控制台中输出，此行可以删除
    codec => rubydebug 
  }
}

• json 插件安装

./logstash-plugin install logstash-codec-json

1.3 启动

nohup ./bin/logstash -f ./config/logstash.conf &

• ps -ef|grep logstash
• 测试是否http://127.0.0.1:9200/

2. springboot配置

2.1 依赖

<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>5.3</version>
</dependency>

2.2 logback.xml配置

<?xml version="1.0" encoding="UTF-8"?>
<configuration debug="false">
    <!--定义日志文件的存储地址 -->
    <property name="LOG_HOME" value="../logs/" />
    <property name="APP_NAME" value="app_name" />

    <property name="COLOR_PATTERN" value="%black(%contextName-) %red(%d{yyyy-MM-dd HH:mm:ss}) %green([%thread]) %highlight(%-5level) %boldMagenta( %replace(%caller{1}){'\t|Caller.{1}0|\r\n', ''})- %gray(%msg%xEx%n)" />
    <!-- 控制台输出 -->
    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <encoder
                class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
            <!--格式化输出：%d表示日期，%thread表示线程名，%-5level：级别从左显示5个字符宽度%msg：日志消息，%n是换行符 -->
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{50}:%L - %msg%n</pattern>
        </encoder>
    </appender>
    
    <!-- 输出到 logstash 配置 -->
    <appender name="logstash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>172.20.5.29:5044</destination>
        <!-- encoder必须配置,有多种可选 -->
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder">
            <customFields>{"appname":"myapp"}</customFields>
        </encoder>
        <connectionStrategy>
            <roundRobin>
                <connectionTTL>5 minutes</connectionTTL>
            </roundRobin>
        </connectionStrategy>
    </appender>

    <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder">
            <customFields>{"appname":"myapp"}</customFields>
        </encoder>
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>${LOG_HOME}/${APP_NAME}-%d{yyyy-MM-dd}.log</fileNamePattern>
        </rollingPolicy>
    </appender>

    <!-- 日志输出级别 -->
    <root level="INFO">
        <appender-ref ref="FILE" />
        <appender-ref ref="STDOUT" />
        <appender-ref ref="logstash" />
    </root>

</configuration>