ELK之整合SpringBoot

Logstash收集Server产生的Log，ES存储收集的数据，并充当检索的工具，Kibana利用数据生成Web界面进行展示。

ELK与SpringBoot的整合，主要指的是logstash与SpringBoot的整合

1.准备一台Linux服务器，服务器地址192.168.124.129

elk下载地址：https://www.elastic.co/downloads/，下载elk安装包

2.安装启动es

• 新建用户/用户组

groupadd es
useradd  es -g es -p 123456

• 授权访问组权限

chown -R es:es /opt/elk/elasticsearch-6.5.3
chmod -R 777 /opt/elk/elasticsearch-6.5.3

•  vim /etc/security/limits.conf

* soft nofile 65536

* hard nofile 131072

* soft nproc 2048

* hard nproc 4096

elasticsearch.yml配置文件

network.host: 192.168.124.129
http.port: 9200

切换到es用户，启动elasticsearch

3.安装启动logstash

新建logstash-logback.conf文件

input{
        tcp {
                mode => "server"
                host => "0.0.0.0"
                port => 4560
                codec => json_lines
        }
}
output{
        elasticsearch{
                hosts=>["192.168.124.129:9200"]
                index => "applog"
                }
        stdout{codec => rubydebug}
}

 启动

./bin/logstash -f config/logstash-logback.conf &

4.安装启动kinana

kibana.yml文件

server.port: 5601
server.host: "192.168.124.129"
elasticsearch.url: "http://192.168.124.129:9200"

5.开放端口

开放logstash的input的4560接收端口,kibana的5601端口

6.新建SpringBoot项目

pom.xml文件引入

<dependency>
	<groupId>net.logstash.logback</groupId>
	<artifactId>logstash-logback-encoder</artifactId>
	<version>5.1</version>
</dependency>

logback.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
	<conversionRule conversionWord="clr"
		converterClass="org.springframework.boot.logging.logback.ColorConverter" />
	<conversionRule conversionWord="wex"
		converterClass="org.springframework.boot.logging.logback.WhitespaceThrowableProxyConverter" />
	<conversionRule conversionWord="wEx"
		converterClass="org.springframework.boot.logging.logback.ExtendedWhitespaceThrowableProxyConverter" />

	<property name="CONSOLE_LOG_PATTERN"
		value="${CONSOLE_LOG_PATTERN:-%clr(%d{yyyy-MM-dd HH:mm:ss.SSS}){faint} %clr(${LOG_LEVEL_PATTERN:-%5p}) %clr(${PID:- }){magenta} %clr(---){faint} %clr([%15.15t]){faint} %clr(%-40.40logger{39}){cyan} %clr(:){faint} %m%n${LOG_EXCEPTION_CONVERSION_WORD:-%wEx}}" />

	<appender name="console" class="ch.qos.logback.core.ConsoleAppender">
		<encoder>
			<pattern>${CONSOLE_LOG_PATTERN}</pattern>
			<charset>utf8</charset>
		</encoder>
		<!-- 临界值过滤器,过滤掉低于指定临界值的日志 -->
		<filter class="ch.qos.logback.classic.filter.ThresholdFilter">
			<level>debug</level>
		</filter>
	</appender>

	<appender name="file"
		class="ch.qos.logback.core.rolling.RollingFileAppender">
		<file>logs/Logback.log</file>
		<encoder>
			<pattern>${CONSOLE_LOG_PATTERN}</pattern>
			<charset>utf8</charset>
		</encoder>
		<!-- 临界值过滤器,过滤掉低于指定临界值的日志 -->
		<filter class="ch.qos.logback.classic.filter.ThresholdFilter">
			<level>debug</level>
		</filter>
		<rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
			<fileNamePattern>logs/%d{yyyy-MM-dd}/Logback.%d{yyyy-MM-dd}.log
			</fileNamePattern>
			<maxHistory>30</maxHistory>
		</rollingPolicy>
	</appender>

	<appender name="stash"
		class="net.logstash.logback.appender.LogstashTcpSocketAppender">
		<destination>192.168.124.129:4560</destination>
		<encoder class="net.logstash.logback.encoder.LogstashEncoder" />
	</appender>

	<!--logger节点,可选节点,用来具体指明包的日志输出级别,它将会覆盖root的输出级别 -->
	<logger name="com.yj" level="debug" />
	<root level="debug">
		<appender-ref ref="stash" />
		<appender-ref ref="console" />
		<appender-ref ref="file" />
	</root>
</configuration>

主要是添加了一个名为stash的appender

application文件

package com.yj;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.boot.CommandLineRunner;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class Application implements CommandLineRunner {
	public static void main(String[] args) {
		SpringApplication.run(Application.class, args);
	}

	@Override
	public void run(String... args) throws Exception {
		Logger logger = LoggerFactory.getLogger(Application.class);
		Thread.currentThread().setName("测试线程");
		for (int i = 0; i < 10; i++) {
			logger.info("info:" + i);
			logger.debug("debug:" + i);
			logger.error("error:" + i);
		}
	}
}

启动项目，logstash控制台看了输出的日志信息

{
    "thread_name" => "测试线程",
     "@timestamp" => 2018-12-17T07:52:25.718Z,
        "message" => "info:9",
          "level" => "INFO",
    "level_value" => 20000,
    "logger_name" => "com.yj.Application",
       "@version" => "1",
           "port" => 60660,
           "host" => "192.168.124.1"
}
{
    "thread_name" => "测试线程",
     "@timestamp" => 2018-12-17T07:52:25.719Z,
        "message" => "error:9",
          "level" => "ERROR",
    "level_value" => 40000,
    "logger_name" => "com.yj.Application",
       "@version" => "1",
           "port" => 60660,
           "host" => "192.168.124.1"
}
{
    "thread_name" => "测试线程",
     "@timestamp" => 2018-12-17T07:52:25.737Z,
        "message" => "Started Application in 2.253 seconds (JVM running for 3.022)",
          "level" => "INFO",
    "level_value" => 20000,
    "logger_name" => "com.yj.Application",
       "@version" => "1",
           "port" => 60660,
           "host" => "192.168.124.1"
}

我们打开kibana的控制台

http://192.168.124.129:5601

也看到了相关的日志记录