springboot集成logstash已经kibans和es-head展示logstash

安装完es,kibana和logstash后，使用kibana查看logstash数据

找了几天，终于找到了，新建索引

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-f2g5Sj7G-1624329381900)(C:\Users\74098\AppData\Roaming\Typora\typora-user-images\image-20210621164456512.png)]

一.参考docker安装logstash中 conf文件配置

记录不同的日志，用不同的配置文件

集成boot使用

input {
    tcp {
        port => 5044
        mode => "server"
        tags => ["tags"]
        codec => json_lines
    }
}
output {
    elasticsearch {
        hosts => "172.17.0.3:9200"
        index => "boot-demo-%{+YYYY.MM.dd}"
    }
}

记录系统日志使用

input {
  file {
    #标签
    type => "systemlog-localhost"
    #采集点
    path => "/var/log/messages"
    #开始收集点
    start_position => "beginning"
    #扫描间隔时间，默认是1s，建议5s
    stat_interval => "5"
  }
}

output {
  elasticsearch {
    hosts => ["172.17.0.3:9200"]
    index => "logstash-system-localhost-%{+YYYY.MM.dd}"
 }
}

一个配置，对应一个配置文件

放在/data/elk7/logstash/config/conf.d/ 中

 docker启动命令，使用本地文件代替docker容器中配置文件
 
 docker run -d \
  --name=logstash \
  --restart=always \
  -p 9600:9600 \
  -p 5044:5044 	 -v /data/elk7/logstash:/usr/share/logstash \
  -v /var/log/messages:/var/log/messages \
  logstash:7.10.1

二.项目中配置

1.logback-spring.xml

配置docker启动中的5044端口

<?xml version="1.0" encoding="UTF-8"?>	
<!DOCTYPE configuration>	
<configuration>	
    <include resource="org/springframework/boot/logging/logback/defaults.xml"/>	
    <include resource="org/springframework/boot/logging/logback/console-appender.xml"/>	
    <!--应用名称-->	
    <property name="APP_NAME" value="mall-admin"/>	
    <!--日志文件保存路径-->	
    <property name="LOG_FILE_PATH" value="${LOG_FILE:-${LOG_PATH:-${LOG_TEMP:-${java.io.tmpdir:-/tmp}}}/logs}"/>	
    <contextName>${APP_NAME}</contextName>	
    <!--每天记录日志到文件appender-->	
    <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">	
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">	
            <fileNamePattern>${LOG_FILE_PATH}/${APP_NAME}-%d{yyyy-MM-dd}.log</fileNamePattern>	
            <maxHistory>30</maxHistory>	
        </rollingPolicy>	
        <encoder>	
            <pattern>${FILE_LOG_PATTERN}</pattern>	
        </encoder>	
    </appender>	
    <!--输出到logstash的appender-->	
    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">	
        <!--可以访问的logstash日志收集端口-->	
        <destination>10.64.3.161:5044</destination>	
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder"/>	
    </appender>	
    <root level="INFO">	
        <appender-ref ref="CONSOLE"/>	
        <appender-ref ref="FILE"/>	
        <appender-ref ref="LOGSTASH"/>	
    </root>	
</configuration>

2.application.xml

spring :
  data: 
    elasticsearch:
      cluster-name: docker-cluster
      #使用的是tcp端口 9300
      cluster-nodes: 10.64.3.161:9300 

3.pom.xml

<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-data-elasticsearch</artifactId>
		</dependency>
		<dependency>
			<groupId>net.logstash.logback</groupId>
			<artifactId>logstash-logback-encoder</artifactId>
			<version>4.11</version>
		</dependency>

三.数据展示

1.es-head展示

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-C3QiIIde-1624329381905)(C:\Users\74098\AppData\Roaming\Typora\typora-user-images\image-20210622100606190.png)]

2.kibana展示

新增索引 根据conf配置文件中索引创建

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-AGJK2lgJ-1624329381907)(C:\Users\74098\AppData\Roaming\Typora\typora-user-images\image-20210622100741597.png)]

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-Giprdljd-1624329381912)(C:\Users\74098\AppData\Roaming\Typora\typora-user-images\image-20210622100648171.png)]

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-Yi4LmizB-1624329381914)(C:\Users\74098\AppData\Roaming\Typora\typora-user-images\image-20210622100730389.png)]

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-xL88hW9Q-1624329381916)(C:\Users\74098\AppData\Roaming\Typora\typora-user-images\image-20210622100808379.png)]

完毕