EFK收集tomcat日志

创建tomcat的topic

[root@localhost kafka]# ./bin/kafka-topics.sh --create --zookeeper 192.168.88.8:2181 --replication-factor 2 --partitions 3 --topic tomcat                           #创建nginx的topic   
Created topic tomcat.
[root@localhost kafka]# ./bin/kafka-console-consumer.sh --bootstrap-server 192.168.88.8:9092 --topic tomcat --from-beginning   #消费

filebeat

[root@kafka02 ~]# cat /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /opt/tomcat/logs/catalina.out
multiline.pattern: ^\[
multiline.negate: true
  multiline.match: after
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
#================================ Outputs =====================================
output.kafka:
  enabled: true
  hosts: ["192.168.88.8:9092","192.168.88.17:9092","192.168.88.8:9092"]
  topic: tomcat
[root@localhost ~]# systemctl restart filebeat
[root@localhost ~]# tailf /var/log/filebeat/filebeat

logstash

[root@kafka02 ~]# cat /etc/logstash/conf.d/tomcat.conf
input {
        kafka {
                bootstrap_servers => ["192.168.88.17:9092,192.168.88.8:9092,192.168.88.88:9092"]
                group_id => "logstash"
                topics => "msg"
                consumer_threads => 5
        }

}
filter {
         json {
                source => "message"
        }
        mutate {
                remove_field => ["@version","fields","prospector","source","host","beat","input","                            offset","log"]
        }



}
output {
        elasticsearch {
                hosts => "192.168.88.8:9200"
                index => "tomcat-%{+YYYY.MM.dd}"
        }
}
[root@localhost ~]# chmod 777 /opt/tomcat/logs -R
[root@localhost logstash]# systemctl restart logstash
[root@localhost logstash]# tailf /var/log/logstash/logstash-plain.log
[root@localhost logstash]# netstat -ntlp | grep 9600
[root@localhost ~]# ab -n 100 -c 100 http://192.168.88.88:8080/index.jsp
[root@localhost kafka]# curl -X GET http://192.168.88.8:9200/_cat/indices?v