Springboot集成ELK完成用户行为日志的记录和检索

一、ELK安装

 

#创建文件夹
mkdir -p /home/docker/elk-docker/mydata/elasticsearch/plugins
mkdir -p /home/docker/elk-docker/mydata/elasticsearch/data
mkdir -p /home/docker/elk-docker/mydata/logstash

#文件夹授权，否则elasticsearch启动会报错
chmod 775 /home/docker/elk-docker/mydata/elasticsearch/plugins
chmod 775 /home/docker/elk-docker/mydata/elasticsearch/data

#创建文件
vi  /home/docker/elk-docker/mydata/logstash/logstash-springboot.conf

#内容如下
input {	
  tcp {	
    mode => "server"	
    host => "0.0.0.0"	
    port => 4560	
    codec => json_lines	
  }	
}	
output {	
  elasticsearch {	
    hosts => "es:9200"	
    index => "tr-center-%{+YYYY.MM.dd}"	
  }	
}

#进入elk主目录，创建docker-compose.yaml文件
cd /home/docker/elk-docker
vi docker-compose.yaml

#内容如下
version: '3'
services:
  elasticsearch:
    image: elasticsearch:6.4.0
    container_name: elasticsearch
    environment:
      - "cluster.name=elasticsearch" #设置集群名称为elasticsearch
      - "discovery.type=single-node" #以单一节点模式启动
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m" #设置使用jvm内存大小
    volumes:
      - ./mydata/elasticsearch/plugins:/usr/share/elasticsearch/plugins #插件文件挂载
      - ./mydata/elasticsearch/data:/usr/share/elasticsearch/data #数据文件挂载
    ports:
      - 9200:9200
  kibana:
    image: kibana:6.4.0
    container_name: kibana
    links:
      - elasticsearch:es #可以用es这个域名访问elasticsearch服务
    depends_on:
      - elasticsearch #kibana在elasticsearch启动之后再启动
    environment:
      - "elasticsearch.hosts=http://es:9200" #设置访问elasticsearch的地址	
    ports:
      - 5601:5601
  logstash:
    image: logstash:6.4.0
    container_name: logstash
    volumes:
      - ./mydata/logstash/logstash-springboot.conf:/usr/share/logstash/pipeline/logstash.conf #挂载logstash的配置文件
    depends_on:
      - elasticsearch #kibana在elasticsearch启动之后再启动
    links:
      - elasticsearch:es #可以用es这个域名访问elasticsearch服务
    ports:
      - 4560:4560

#使用
docker-compose up -d指令启动elk

#在logstash中安装json_lines插件

# 进入logstash容器	
docker exec -it logstash /bin/bash	
# 进入bin目录	
cd /bin/	
# 安装插件	
logstash-plugin install logstash-codec-json_lines	
# 退出容器	
exit	
# 重启logstash服务	
docker restart logstash

#访问kibana验证服务是否安装正常
http://192.168.0.11:5601

二、创建索引

三、集成ELK

3.1、在pom.xml中添加logstash-logback-encoder依赖

<!--集成logstash-->    
<dependency>    
    <groupId>net.logstash.logback</groupId>    
    <artifactId>logstash-logback-encoder</artifactId>    
    <version>5.3</version>    
</dependency>

3.2、添加配置文件logback-spring.xml让logback的日志输出到logstash

<?xml version="1.0" encoding="UTF-8"?>	
<!DOCTYPE configuration>	
<configuration>	
    <include resource="org/springframework/boot/logging/logback/defaults.xml"/>	
    <include resource="org/springframework/boot/logging/logback/console-appender.xml"/>	
    <!--应用名称-->	
    <property name="APP_NAME" value="mall-admin"/>	
    <!--日志文件保存路径-->	
    <property name="LOG_FILE_PATH" value="${LOG_FILE:-${LOG_PATH:-${LOG_TEMP:-${java.io.tmpdir:-/tmp}}}/logs}"/>	
    <contextName>${APP_NAME}</contextName>	
    <!--每天记录日志到文件appender-->	
    <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">	
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">	
            <fileNamePattern>${LOG_FILE_PATH}/${APP_NAME}-%d{yyyy-MM-dd}.log</fileNamePattern>	
            <maxHistory>30</maxHistory>	
        </rollingPolicy>	
        <encoder>	
            <pattern>${FILE_LOG_PATTERN}</pattern>	
        </encoder>	
    </appender>	
    <!--输出到logstash的appender-->	
    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">	
        <!--可以访问的logstash日志收集端口-->	
        <destination>192.168.0.11:4560</destination>	
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder"/>	
    </appender>	
    <root level="INFO">	
        <appender-ref ref="CONSOLE"/>	
        <appender-ref ref="FILE"/>	
        <appender-ref ref="LOGSTASH"/>	
    </root>	
</configuration>