elk 日志查询系统搭建

elk 服务端配置

docker-compose 部署服务

version: '3.0'

services:
  elasticsearch:
    restart: always
    image: elasticsearch:7.4.0
    ports:
      - "9200:9200"
      - "9300:9300"
    container_name: "es"
    volumes:
    # 挂载目录
      - ./elk/es/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
    environment:
      - TZ=Asia/Shanghai
      - discovery.type=single-node
    networks:
      - esnet
  kibana:
    restart: always
    image: kibana:7.4.0
    container_name: "kibana"
    volumes:
      - ./elk/kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml:ro
    ports:
      - "5601:5601"
    environment:
      - TZ=Asia/Shanghai
    networks:
      - esnet
  logstash:
    restart: always
    image: logstash:7.4.0
    container_name: logstash
    ports:
      - 4560:4560
      - 9600:9600
    environment:
      - TZ=Asia/Shanghai
    volumes:
    # 挂载目录
      - ./elk/logstash/config/:/usr/share/logstash/config/
    networks:
      - esnet

networks:
  esnet:
    # Use a custom driver
    driver: bridge

在/root/elk/es/config 下创建 elasticsearch.yml

# 节点名
cluster.name: "my-es-7.4.0"
network.host: 0.0.0.0

# 支持跨域
http.cors.enabled: true
http.cors.allow-origin: "*"

在/root/elk/kibana/config 下创建 kibana.yml

# 服务名
server.name: kibana
server.host: "0"
# 连接 es 的配置，这个可以是集群
elasticsearch.hosts: [ "http://localhost:9200" ]
xpack.monitoring.ui.container.elasticsearch.enabled: true
# 设置中文
i18n.locale: "zh-CN"

在/root/elk/logstash/config 下创建 logstash.yml

在/root/elk/logstash/config 下创建 log4j2.properties

logger.elasticsearchoutput.name = logstash.outputs.elasticsearch
logger.elasticsearchoutput.level = debug

在/root/elk/logstash/config 下创建 pipelines.yml(配置input-filter-output)

- pipeline.id: my-logstash
  path.config: "/usr/share/logstash/config/*.conf"
  pipeline.workers: 3

在/root/elk/logstash/config 下创建*.conf 文件(流的输入输出配置)

input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4560
  }
}
output {
  elasticsearch {
    action => "index"
    # 配置es连接
    hosts  => "ip:9200"
    # 配置索引
    index  => "index"
  }
}

打开http://localhost:5601

elk 客户端配置

引入依赖

		<dependency>
            <groupId>net.logstash.logback</groupId>
            <artifactId>logstash-logback-encoder</artifactId>
            <version>5.2</version>
        </dependency>

logback-spring.xml的配置

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
	<!-- 应用名 -->
    <springProperty scope="context" name="appName" source="spring.application.name" />
    <!-- 端口 -->
    <springProperty scope="context" name="ip" source="server.port" />
    <!-- 应用中文名 -->
    <property name="serviceName" value="consumer" />

    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
       <!-- logstash开放的地址 -->
        <destination>ip:4560</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <providers>
                <timestamp>
                    <timeZone>UTC</timeZone>
                </timestamp>
                <pattern>
                    <pattern>
                        {
                        <!-- 日志级别 -->
                        "level": "%level",
                        <!-- 应用IP -->
                        "ip": "${ip}",
                        <!-- 服务名称 作为索引 -->
                        "appname": "${appName}",
                        <!-- 应用名称 -->
                        "serviceName": "${serviceName}",
                        "pid": "${PID:-}",
                        "thread": "%thread",
                        "class": "%logger{40}",
                         <!-- 日志详情 -->
                        "disc": "%message",
                        <!-- 异常详情 -->
                        "stack_trace": "%exception"
                        }
                    </pattern>
                </pattern>
            </providers>
        </encoder>
    </appender>

    <include resource="org/springframework/boot/logging/logback/base.xml"/>

    <!-- 日志输出级别 -->
    <root level="INFO">
        <appender-ref ref="LOGSTASH" />
        <appender-ref ref="CONSOLE" />
    </root>

</configuration>