boot - 整合 logstash , 发送日志到 es

boot - 整合 logstash , 发送日志到 es

基于 es: 7.10.x

引入依赖

  <dependency>
      <groupId>net.logstash.logback</groupId>
      <artifactId>logstash-logback-encoder</artifactId>
      <version>6.6</version>
  </dependency>

配置日志 logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE configuration>
<configuration>
    <springProperty scope="context" name="appName" source="spring.application.name"/>
    //使用tcp方式发送日志到logstash
    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>192.168.1.17:5044</destination>
<!--        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder" >-->
<!--            <pattern>-->
<!--                { "logLevel": "%level", "serviceName": "${appName:-}", "pid": "${PID:-}", "thread": "%thread", "class": "%logger{40}", "msg": "%message" }-->
<!--            </pattern>-->
<!--            <charset>GBK</charset>-->
<!--        </encoder>-->
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <providers>
                <timestamp>
                    <timeZone>UTC</timeZone>
                </timestamp>
                <pattern>
                    <pattern>
                        { "logLevel": "%level", "serviceName": "${appName:-}", "pid": "${PID:-}", "thread": "%thread", "class": "%logger{40}", "msg": "%message" }
                    </pattern>
                </pattern>
            </providers>
        </encoder>
    </appender>

    <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
            <!--格式化输出：%d表示日期，%thread表示线程名，%-5level：级别从左显示5个字符宽度%msg：日志消息，%n是换行符-->
            <pattern>[%d{yyyy-MM-dd HH:mm:ss.SSS}] [%thread] %highlight([%-5level] %logger{50} - %msg%n)</pattern>
            <charset>GBK</charset>
        </encoder>
    </appender>

    <root level="DEBUG">
        <appender-ref ref="LOGSTASH" />
        <appender-ref ref="CONSOLE" />
    </root>

</configuration>

logstash 配置

input {
    syslog {
        port => "514"
    }
    redis {
        data_type => "pattern_channel"
        key => "logstash-*"
        host => "192.168.1.123"
        port => 6379
        threads => 1
        password => "111111" #如果有安全认证，此项为密码
        type => redis
    }

	//启动日志监听
    tcp{
        port => 5044
        codec => plain{charset => "UTF-8"}
        type => boot
    }
}

output { 

    if [type] == "redis"{
        elasticsearch {
            action => "index"
            hosts => ["192.168.1.123:9200"]
            index => "logstash-%{type}-%{+YYYY.MM.dd}"
        }
    }
    else if [type] == "boot"{
        elasticsearch {
            document_type => "_doc"
            action => "index"
            hosts => ["192.168.1.123:9200"]
            index => "boot-%{+YYYY.MM.dd}"
            manage_template => true
            template => "/usr/share/logstash/config/tpl/tpl-boot.json"
            template_name => "tpl-boot.json"
            template_overwrite => true
        }
    }
    stdout { codec => rubydebug }
}

测试代码

@GetMapping("/echo")
public String echo(@RequestParam("q") String q){
    log.info("echo : "+ q);
    log.debug("echo : "+ q);
    log.error("echo : "+ q);
    log.trace("echo : "+ q);
    return "echo";
}

在 kibana 中可以看到