ELK收集Spring项目日志

ELK管理Spring项目
搭建ELK服务，步骤略；ELK搭建
搭建Spring项目，本文以SpringBoot项目为例，添加依赖；

<dependency>
     <groupId>net.logstash.logback</groupId>
     <artifactId>logstash-logback-encoder</artifactId>
     <version>5.3</version>
</dependency>

在SpringBoot项目的根目录下面添加logback-spring.xml配置文件，配置logback日志信息，注意这里配置的属性destination，输出的要和logstash配置的对应上，不然收集不了；
logback-spring.xml样例：

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <include resource="org/springframework/boot/logging/logback/base.xml" />
    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>192.168.254.130:5044</destination>
        <!-- 日志输出编码 -->
        <encoder charset="UTF-8"
                 class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <providers>
                <timestamp>
                    <timeZone>UTC</timeZone>
                </timestamp>
                <pattern>
                    <pattern>
                        {
                        "logLevel": "%level",
                        "serviceName": "${springAppName:-}",
                        "pid": "${PID:-}",
                        "thread": "%thread",
                        "class": "%logger{40}",
                        "rest": "%message"
                        }
                    </pattern>
                </pattern>
            </providers>
        </encoder>
    </appender>

    <root level="INFO">
        <appender-ref ref="LOGSTASH" />
        <appender-ref ref="CONSOLE" />
    </root>

</configuration>

logstash配置；
logstash配置如下，再次提醒，输入要和logback-spring.xml配置的地址对应上，输出为本地的ES

input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 5044
    codec => json_lines
  }
}
output {
  elasticsearch {
    hosts => "localhost:9200"
    index => "springboot-logstash-%{+YYYY.MM.dd}"
  }
}

注意：上篇文章搭建的ELK设置的日志发送位置是ElasticSearch，如果是收取项目里面的日志则需要改成Logstash