ELK第四讲之【docker安装Logstash8.4.3、集成springboot】

docker安装elasticsearch8.4.3

docker安装kibana8.4.3

一、docker安装logstash8.4.3

官方地址 https://github.com/elastic/logstash/releases

1、拉取镜像

docker pull elastic/logstash:8.4.3 

2、启动容器

docker run -it -d  --name logstash  -p 9600:9600  -p 5044:5044  logstash:8.4.3

3、创建挂载目录、复制数据卷

mkdir -vp /usr/local/docker/logstash
#赋于权限
sudo chown -R 1000:1000 /usr/local/docker/logstash
#复制数据卷
docker cp logstash:/usr/share/logstash/config /usr/local/docker/logstash/
docker cp logstash:/usr/share/logstash/pipeline /usr/local/docker/logstash/

4、编辑信息logstash.yml

vim /usr/local/docker/logstash/config/logstash.yml

http.host: "0.0.0.0"
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.hosts: [ "http://192.168.11.143:9200" ]
#xpack.monitoring.elasticsearch.username: "elastic"  #es xpack账号
#xpack.monitoring.elasticsearch.password: "xxxx"     #es xpack账号

5、编辑日志配置信息logstash.conf

vim /usr/local/docker/logstash/pipeline/logstash.conf

input {
 tcp {
  #采集端口
   port => 5044
   #输出格式
   codec => json_lines
 }
}
output {
 elasticsearch {
  #输入日志到那个服务器
   hosts => ["http://192.168.11.144:9200"]
   #索引名称(kibana中以该名称查看日志)
   index => "my-log-%{+YYYY.MM.dd}"
 }
 stdout {
   codec => rubydebug
 }
}

6、停止、删除容器

docker stop logstash
docker rm -f logstash

7、重启容器(指定容器数据卷)

docker run -it -d \
  --name logstash \
  --restart=always --privileged=true \
  -e ES_JAVA_OPTS="-Xms1g -Xmx1g" \
  -p 9600:9600 -p 5044:5044 \
  -v /usr/local/docker/logstash/config:/usr/share/logstash/config \
  -v /usr/local/docker/logstash/pipeline:/usr/share/logstash/pipeline \
  logstash:8.4.3

8、开放端口

firewall-cmd --zone=public --add-port=5044/tcp --permanent && firewall-cmd --reload
firewall-cmd --zone=public --add-port=9600/tcp --permanent && firewall-cmd --reload 

二、springboot项目集成

1、添加logstash依赖

<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>7.0.1</version>
</dependency>

2、准备logback-spring.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <include resource="org/springframework/boot/logging/logback/base.xml" />
    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
    <!--    此处填写的是logstash采集日志的端口    -->
     <destination>192.168.11.131:5044</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder" />
    </appender>
    <root level="INFO">
        <appender-ref ref="LOGSTASH" />
        <appender-ref ref="CONSOLE" />
    </root>
</configuration>

3、在application.yml中配置log

logging:
  config: classpath:logback-spring.xml

4、查看效果