logback输入日志到logstash

logback输入日志到logstash的方法
1.配置logstash-6.5.0中的logstash.conf文件
增加tcp模块，注意开放端口,格式必须为json

# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pi
input {
            file {
                    path => "/home/emeet/apache-tomcat-9.0.16/logs/tomcat_access_log*.log"
                    start_position => "beginning" #从文件开始处读写
		    type => "tomcat-access-log"
            }
	    file {
       		path => "/usr//local/nginx18/logs/access_json.log"
       		codec => json
       		start_position => "beginning"
       		type => "nginx-log"
   	     }
	      tcp {
		port => 8065
		codec => "json"
		type => "usermanagement-log"
		}
    #       stdin {}  #可以从标准输入读数据
    }
 
    # 输出到本机的 ES
    output {
	if [type] == "nginx-log"{
        	elasticsearch {
           		hosts => ["127.0.0.1:9200"]
           		index => "nginx-log-%{+YYYY.MM.dd}"
        	}
	}
	if [type] == "tomcat-access-log"{

        	elasticsearch {
                	hosts => [ "127.0.0.1:9200"]
  			index => "tomcat-access-log-%{+YYYY.MM.dd}"
        	}
	}    
	if [type] == "usermanagement-log"{

                elasticsearch {
                        hosts => [ "127.0.0.1:9200"]
                        index => "usermanagement-log-%{+YYYY.MM.dd}"
                }
        }

    }

重新启动logstash
2.配置spring-boot
pom.xml中添加：

<dependency>
	<groupId>net.logstash.logback</groupId>
	<artifactId>logstash-logback-encoder</artifactId>
	<version>4.11</version>
</dependency>

配置logback-spring-prod.xml
添加一个appender

<appender name="LOGSTASH"
	class="net.logstash.logback.appender.LogstashTcpSocketAppender">
	<destination>111.222.333.444:8065</destination>
	<!-- encoder必须配置,有多种可选 -->
	<encoder charset="UTF-8"
		class="net.logstash.logback.encoder.LogstashEncoder">
		<customFields>{"appname":"testlog", "message": "%msg"}</customFields>
	</encoder>
</appender>

为了日志不是断行的，加上"message": “%msg”，一个异常信息就会在一条记录中了
也可以类似下面这种：

        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <providers>
                <pattern>
                    <pattern>
                        <!--输出日志可自定义，可根据自己需要配置-->
                        {
                        <!--es索引名称 -->
                        "indexname":"test_logstash",
                        <!--应用名称 -->
                        "appname":"${spring.application.name}",
                        <!--服务器ip -->
                        "host": "%ip",
                        <!--应用端口 -->
                        "port": "${spring.application.index}",
                        <!--打印时间 -->
                        "timestamp": "%d{yyyy-MM-dd HH:mm:ss.SSS}",
                        <!--线程名称 -->
                        "thread": "%thread",
                        <!--日志级别 -->
                        "level": "%level",
                        <!--日志名称 -->
                        "logger_name": "%logger",
                        <!--日志信息 -->
                        "message": "%msg",
                        <!--日志堆栈 -->
                        "stack_trace": "%exception"
                        }
                    </pattern>
                </pattern>
            </providers>
        </encoder>

 <encoder class="net.logstash.logback.encoder.LogstashEncoder">
            <throwableConverter class="net.logstash.logback.stacktrace.ShortenedThrowableConverter">
                <!--正则匹配的日志信息不输出-->
                <exclude>sun\.reflect\..*\.invoke.*</exclude>
                <exclude>net\.sf\.cglib\.proxy\.MethodProxy\.invoke</exclude>
                <exclude>org.*</exclude>
                <rootCauseFirst>true</rootCauseFirst>
            </throwableConverter>
        </encoder>

再加上输出即可

<root level="debug">
	<!-- 文件输出 -->
	<appender-ref ref="ERROR" />
	<appender-ref ref="INFO" />
	<appender-ref ref="WARN" />
	<appender-ref ref="DEBUG" />
	<appender-ref ref="TRACE" />
	<appender-ref ref="LOGSTASH" />
</root>