logstash config
log4j
input {
log4j {
mode => "server"
host => "0.0.0.0"
port => 4560
}
}
output{
stdout {
codec => rubydebug
}
elasticsearch {
hosts => ["host1:9200"]
index => "log4j-%{+YYYY.MM.dd}"
document_type => "log4j_type"
}
}
复制代码
logback
input {
tcp {
port => 4560
codec => "json"
}
}
output{
stdout {
codec => rubydebug
}
elasticsearch {
hosts => ["localhost:9200"]
index => "logback-%{+YYYY.MM.dd}"
document_type => "logback_type"
}
}
复制代码
log4j.properties
log4j.rootLogger=debug,stdout,tcp
#logstash appender
log4j.appender.tcp=org.apache.log4j.net.SocketAppender
log4j.appender.tcp.Port=4560
log4j.appender.tcp.RemoteHost=localhost
log4j.appender.tcp.ReconnectionDelay=10000
复制代码
logback.xml
<dependency>
<groupId>net.logstash.logback</groupId>
<artifactId>logstash-logback-encoder</artifactId>
<version>4.11</version>
</dependency>
复制代码
<appender name="STASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
<destination>localhost:4560</destination>
<encoder class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
<providers>
<!--<mdc/> <!– MDC variables on the Thread will be written as JSON fields–>-->
<!--<context/> <!–Outputs entries from logback's context –>-->
<!--<version/> <!– Logstash json format version, the @version field in the output–>-->
<logLevel/>
<!--<loggerName/>-->
<pattern>
<pattern>
{
"appName": "yourappname",
"appVersion": "1.0"
}
</pattern>
</pattern>
<threadName/>
<message/>
<logstashMarkers/> <!-- Useful so we can add extra information for specific log lines as Markers-->
<arguments/> <!--or through StructuredArguments-->
<stackTrace/>
</providers>
</encoder>
</appender>
复制代码