ELK的配置

1. 本地 ELK
   https://github.com/deviantony/docker-elk
   docker compose up

2. 更改logstash.conf 接受 codec => “json”
   发送给 index => “applog-%{+YYYY.MM.dd}”
   https://github.com/logstash/logstash-logback-encoder

input {
	beats {
		port => 5044
	}

	tcp {
		port => 5000
		# codec => plain { charset => "UTF-8" }
		codec => "json"
	}
}

## Add your filters / logstash plugins configuration here

output {
	elasticsearch {
		hosts => "elasticsearch:9200"
		user => "elastic"
		password => "changeme"
		# ecs_compatibility => disabled
		# index => "%{[@metadata][beat]}-%{[@metadata][version]}"
		# index => "applog"
		index => "applog-%{+YYYY.MM.dd}"
	}
}

3. 加入如下appender

	<appender name="logstash"
		class="net.logstash.logback.appender.LogstashTcpSocketAppender">
		<param name="Encoding" value="UTF-8" />

		<!-- should be an env variable in production -->
		<remoteHost>${logstash.host}</remoteHost>

		<!-- should be an env variable in production -->
		<port>5000</port>
		<!-- <destination>100.122.118.16:5000</destination> -->
		   <encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
                      <providers>
    <timestamp/>
    <version/>
    <pattern>
	  <pattern>
        {
          "component": "webserver",
		  "service": "${application.name:-}",
          "datacenter":"ord",
		  "host":"${HOSTNAME}"
        }
		</pattern>
    </pattern>
        <message/>
        <loggerName/>
        <threadName/>
        <logLevel/>
        <callerData/>
        <stackTrace/>
        <context/>
        <mdc/>
        <tags/>
        <logstashMarkers/>
        <arguments/>
  </providers>
		
        </encoder>
	</appender>