docker部署elk环境，附java代码

1.配置logstash配置文件

1.1 配置02-beats-input.conf
vi /app/elk/conf/02-beats-input.conf

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
ruby {
  code => "event.set('index_date', event.get('@timestamp').time.localtime + 8*60*60)"
     }
   }

1.2配置10-syslog.conf

vi /app/elk/conf/10-syslog.conf

input {
  tcp {
    port => 5044
    codec => "json"
   }
}

1.3 配置11-nginx.conf

vi /app/elk/conf/11-nginx.conf

filter {
  if [type] == "nginx-access" {
    grok {
      match => { "message" => "%{NGINXACCESS}" }
    }
  }
}

1.4 配置30-output.conf

vi /app/elk/conf/30-output.conf

output {
  elasticsearch {
    hosts => ["host_ip:9203"]
    index => "%{[product]}.%{[service]}.%{[env]}-%{+YYYY.MM.dd}"
   }
}

2.启动elk服务

docker run -d  \
--ulimit nofile=65536:65536 \
-p 5045:5044 \
-p 5601:5601 \
-p 9203:9200 \
-p 5055:5055 \
-v /app/elk/data:/var/lib/elasticsearch \
-v /app/elk/conf:/etc/logstash/conf.d \
--name=elk \
--restart=always \
sebp/elk

3.Java代码配置elk
3.1引入依赖

<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>5.2</version>
</dependency

3.2 配置logback-spring.xml

注意替换host_ip地址。

<appender name="logstash"
        class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>host_ip:5045</destination>
        <encoder charset="UTF-8"
            class="net.logstash.logback.encoder.LogstashEncoder">
            <includeContext>false</includeContext>
            <customFields>{"product":"cbmp","service":"${appName}","env":"test"}</customFields>
        </encoder>
</appender>

测试代码

@RestController
public class IndexController {
    private final Logger logger = LoggerFactory.getLogger(getClass());

    @GetMapping("/index")
    public Object index() {
        logger.debug("======ELK2测试=======");
        logger.info("======ELK2测试=======");
        logger.warn("======ELK2测试=======");
        logger.error("======ELK2测试=======");

        return "success";
    }
}