日志（包含log4j和logback）传入logstash

logstash config

log4j

input {
     log4j {
	mode => "server"
	host => "0.0.0.0"
        port => 4560
     }
 }
 
 output{
   stdout {
   	  codec => rubydebug
   }
   elasticsearch {
   	  hosts => ["host1:9200"]
   	  index => "log4j-%{+YYYY.MM.dd}"
   	  document_type => "log4j_type"
   }
 }
复制代码

logback

input {
    tcp {
      port => 4560
      codec => "json"
    }
}

output{
  stdout {
     codec => rubydebug
  }
  elasticsearch {
  	  hosts => ["localhost:9200"]
  	  index => "logback-%{+YYYY.MM.dd}"
  	  document_type => "logback_type"
  }
}
复制代码

log4j.properties

log4j.rootLogger=debug,stdout,tcp

#logstash appender
log4j.appender.tcp=org.apache.log4j.net.SocketAppender
log4j.appender.tcp.Port=4560
log4j.appender.tcp.RemoteHost=localhost
log4j.appender.tcp.ReconnectionDelay=10000
复制代码

logback.xml

<dependency>
   <groupId>net.logstash.logback</groupId>
   <artifactId>logstash-logback-encoder</artifactId>
   <version>4.11</version>
</dependency>
复制代码

<appender name="STASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>localhost:4560</destination>

        <encoder class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <providers>
                <!--<mdc/> &lt;!&ndash; MDC variables on the Thread will be written as JSON fields&ndash;&gt;-->
                <!--<context/> &lt;!&ndash;Outputs entries from logback's context &ndash;&gt;-->
                <!--<version/> &lt;!&ndash; Logstash json format version, the @version field in the output&ndash;&gt;-->
                <logLevel/>
                <!--<loggerName/>-->

                <pattern>
                    <pattern>
                    {
                        "appName": "yourappname",
                        "appVersion": "1.0"
                        }
                    </pattern>
                </pattern>

                <threadName/>
                <message/>

                <logstashMarkers/> <!-- Useful so we can add extra information for specific log lines as Markers-->
                <arguments/> <!--or through StructuredArguments-->

                <stackTrace/>
            </providers>
        </encoder>
    </appender>
复制代码