Springboot部署ELK实战

1、部署docker、docker-compose环境

安装docker

# 安装docker
curl -fsSL get.docker.com -o get-docker.sh
sudo sh get-docker.sh --mirror Aliyun

# docker开机自启
systemctl enable docker
# 启动docker
systemctl start docker

# 创建docker用户组
groupadd docker

# 当前用户加入docker组
usermod -aG docker $USER

# 测试安装是否正确
docker info
docker run hello-world

# 配置镜像服务
mkdir -p /etc/docker
tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": ["https://6xe6xbbk.mirror.aliyuncs.com"]
}
EOF
# 重新加载
systemctl daemon-reload
# 重启docker
systemctl restart docker

安装docker-compose

# 安装docker-compose依赖
curl -L https://github.com/docker/compose/releases/download/1.25.5/docker-compose-`uname -s`-`uname -m` > /usr/local/bin/docker-compose
# 添加执行权限
chmod +x /usr/local/bin/docker-compose
# 查看是否安装成功
docker compose version

2、搭建elk

1、构建目录&&配置文件

按照图中展示的层级创建目录以及文件

共创建2个目录 kibana、logstash，3个文件docker-compose.yml、kibana.yml、log-config.conf

1、docker-compose.yml 文档

version: "3.3"
volumes:
  data:
  config:
  plugin:
networks:
  es:
services:
  elasticsearch:
    image: elasticsearch:7.14.0
    ports:
      - "9200:9200"
    networks:
      - "es"
    environment:
    # 单节点模式
      - "discovery.type=single-node"
      - "ES_JAVA_OPTS=-Xms1024m -Xmx1024m"
   # 文件挂载
    volumes:
      - data:/usr/share/elasticsearch/data
      - config:/usr/share/elasticsearch/config
      - plugin:/usr/share/elasticsearch/plugins

  kibana:
    image: kibana:7.14.0
    ports:
      - "5601:5601"
    networks:
      - "es"
    volumes:
      - ./kibana/kibana.yml:/usr/share/kibana/config/kibana.yml
  logstash:
    image: logstash:7.14.0
    ports:
      - "4560:4560"
      - "4561:4561"
    networks:
      - "es"
    volumes:
      - ./logstash/log-config.conf:/usr/share/logstash/pipeline/logstash.conf

2、Kibana.yml

server.host: "0"
server.shutdownTimeout: "5s"
elasticsearch.hosts: [ "http://elasticsearch:9200" ]
monitoring.ui.container.elasticsearch.enabled: true
i18n.locale: "zh-CN" # 这个是为了可视化界面展示为中文

3、log-config.conf

input {
# logback发送日志信息，为tcp模式，也可以使用redis、kafka等方式进行日志的发送
  tcp {
  # logstash接收数据的端口和ip
  # 4560收集日志级别为info
    mode => "server"
    host => "0.0.0.0"
    port => 4560
    codec => json_lines
    type => "info"
  }
  tcp {
  # 4561收集日志级别为error
    mode => "server"
    host => "0.0.0.0"
    port => 4561
    codec => json_lines
    type => "error"
  }
}
output {
  elasticsearch {
    hosts => "elasticsearch:9200"
    # 可自定义，通过参数值补充，不存在的索引会先创建再赋值
    # 按日生成索引
    index => "logutils-%{type}-%{+YYYY-MM-dd}" 
  }
  # 输出到控制台
  stdout { codec => rubydebug }
}

2、添加es分词器插件

todo 引入插件

# 将分词器放在创建es镜像所指定的插件挂载目录
plugin:/usr/share/elasticsearch/plugins
# 检索当前所有的卷
docker volume ls

# 查找es挂载插件目录的绝对路径
docker volume inspect elk_workspace_plugin

# 将ik-7.14.0.zip 解压到es挂载插件目录的对接路径
unzip -d /var/lib/docker/volumes/elk_workspace_plugin/_data ik-7.14.0.zip

3、启动

# 在当前docker-compose.yml 同级目录下启动
# -d 后台启动
docker-compose up -d 

# 查看运行情况
docker ps -a

# 查看运行日志
docker logs -f 容器id/容器名查看运行日志

# 停止运行
docker-comopse down

# 强制读取更新配置后重启
docker-compose up --force-recreate -d 

3、Springboot项目引入es、logStash配置

1、引入依赖

<!--集成logstash-->
<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>5.3</version>
</dependency>

<!--elasticsearch-->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-elasticsearch</artifactId>
    <version>2.3.10.RELEASE</version>
</dependency>

2、修改application.yml配置文件

spring:
 elasticsearch:
   # 此处替换对应ip
    uris: ip:9200

3、调整logback.properties配置文件

message的配置根据需要，sessionId、traceId是通过配置才能引用的

  "message": "[%X{sessionId}] [%X{traceId}] %class:%line <![CDATA[%message]]>"

 <!--LogStash访问host-->
 <springProperty  scope="context" name="LOG_STASH_HOST" source="logstash.host"/>
    
  <!--ERROR日志输出到LogStash-->
    <appender name="LOG_STASH_ERROR" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <filter class="ch.qos.logback.classic.filter.LevelFilter">
            <level>ERROR</level>
            <onMatch>ACCEPT</onMatch>
            <onMismatch>DENY</onMismatch>
        </filter>
        <!-- 这里定义转发ip和端口 -->
        <destination>ip:4561</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <providers>
                <timestamp>
                    <timeZone>Asia/Shanghai</timeZone>
                </timestamp>
                <!--自定义日志输出格式-->
                <pattern>
                    <pattern>
                        {
                        "project": "logutils-error",
                        "level": "%level",
                        "service": "${APP_NAME:-}",
                        "thread": "%thread",
                        "class": "%logger",
                        "message": "[%X{sessionId}] [%X{traceId}] %class:%line <![CDATA[%message]]>",
                        "stack_trace": "%exception{20}",
                        "classLine":"%class:%line"
                        }
                    </pattern>
                </pattern>
            </providers>
        </encoder>
    </appender>
    <!--接口访问记录日志输出到LogStash-->
    <appender name="LOG_STASH_RECORD" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>ip:4560</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <providers>
                <timestamp>
                    <timeZone>Asia/Shanghai</timeZone>
                </timestamp>
                <!--自定义日志输出格式-->
                <pattern>
                    <pattern>
                        {
                        "project": "logutils-info",
                        "level": "%level",
                        "service": "${APP_NAME:-}",
                        "class": "%logger",
                        "message": "[%X{sessionId}] [%X{traceId}] %class:%line %message",
                        "thread": "%thread",
                        "classLine":"%class:%line"
                        }
                    </pattern>
                </pattern>
            </providers>
        </encoder>
    </appender>
    
    <logger name="com" level="ERROR">
     <appender-ref ref="LOG_STASH_ERROR"/>
    </logger>

    <logger name="com" level="INFO">
     <appender-ref ref="LOG_STASH_RECORD"/>
    </logger>

4、使用情况

1、查看服务是否成功运行

Eleasticsearch: http://ip:9200

Kibana: http://ip:5601

2、Kibana管理索引

检索Stack Management

创建索引模式

启动后会自动生成对应的索引提供选择

配置按照@timestamp 作为全局时间筛选

3、日志搜索

以上便是Springboot部署ELK实战的全部内容，如有解析不当欢迎在评论区指出！