安装完es,kibana和logstash后,使用kibana查看logstash数据
找了几天,终于找到了,新建索引
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-f2g5Sj7G-1624329381900)(C:\Users\74098\AppData\Roaming\Typora\typora-user-images\image-20210621164456512.png)]
一.参考docker安装logstash中 conf文件配置
记录不同的日志,用不同的配置文件
集成boot使用
input {
tcp {
port => 5044
mode => "server"
tags => ["tags"]
codec => json_lines
}
}
output {
elasticsearch {
hosts => "172.17.0.3:9200"
index => "boot-demo-%{+YYYY.MM.dd}"
}
}
记录系统日志使用
input {
file {
#标签
type => "systemlog-localhost"
#采集点
path => "/var/log/messages"
#开始收集点
start_position => "beginning"
#扫描间隔时间,默认是1s,建议5s
stat_interval => "5"
}
}
output {
elasticsearch {
hosts => ["172.17.0.3:9200"]
index => "logstash-system-localhost-%{+YYYY.MM.dd}"
}
}
一个配置,对应一个配置文件
放在/data/elk7/logstash/config/conf.d/ 中
docker启动命令,使用本地文件代替docker容器中配置文件
docker run -d \
--name=logstash \
--restart=always \
-p 9600:9600 \
-p 5044:5044 -v /data/elk7/logstash:/usr/share/logstash \
-v /var/log/messages:/var/log/messages \
logstash:7.10.1
二.项目中配置
1.logback-spring.xml
配置docker启动中的5044端口
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE configuration>
<configuration>
<include resource="org/springframework/boot/logging/logback/defaults.xml"/>
<include resource="org/springframework/boot/logging/logback/console-appender.xml"/>
<!--应用名称-->
<property name="APP_NAME" value="mall-admin"/>
<!--日志文件保存路径-->
<property name="LOG_FILE_PATH" value="${LOG_FILE:-${LOG_PATH:-${LOG_TEMP:-${java.io.tmpdir:-/tmp}}}/logs}"/>
<contextName>${APP_NAME}</contextName>
<!--每天记录日志到文件appender-->
<appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
<rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
<fileNamePattern>${LOG_FILE_PATH}/${APP_NAME}-%d{yyyy-MM-dd}.log</fileNamePattern>
<maxHistory>30</maxHistory>
</rollingPolicy>
<encoder>
<pattern>${FILE_LOG_PATTERN}</pattern>
</encoder>
</appender>
<!--输出到logstash的appender-->
<appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
<!--可以访问的logstash日志收集端口-->
<destination>10.64.3.161:5044</destination>
<encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder"/>
</appender>
<root level="INFO">
<appender-ref ref="CONSOLE"/>
<appender-ref ref="FILE"/>
<appender-ref ref="LOGSTASH"/>
</root>
</configuration>
2.application.xml
spring :
data:
elasticsearch:
cluster-name: docker-cluster
#使用的是tcp端口 9300
cluster-nodes: 10.64.3.161:9300
3.pom.xml
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-elasticsearch</artifactId>
</dependency>
<dependency>
<groupId>net.logstash.logback</groupId>
<artifactId>logstash-logback-encoder</artifactId>
<version>4.11</version>
</dependency>
三.数据展示
1.es-head展示
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-C3QiIIde-1624329381905)(C:\Users\74098\AppData\Roaming\Typora\typora-user-images\image-20210622100606190.png)]
2.kibana展示
新增索引 根据conf配置文件中索引创建
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-AGJK2lgJ-1624329381907)(C:\Users\74098\AppData\Roaming\Typora\typora-user-images\image-20210622100741597.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-Giprdljd-1624329381912)(C:\Users\74098\AppData\Roaming\Typora\typora-user-images\image-20210622100648171.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-Yi4LmizB-1624329381914)(C:\Users\74098\AppData\Roaming\Typora\typora-user-images\image-20210622100730389.png)]
[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-xL88hW9Q-1624329381916)(C:\Users\74098\AppData\Roaming\Typora\typora-user-images\image-20210622100808379.png)]
完毕