ELK-Tomcat 日志转json并收集

一 安装tomcat

准备好tomcat的包
-rw-r–r-- 1 root root 9488296 Jun 3 2018 apache-tomcat-7.0.69.zip
[root@linux-node4 ~]# mkdir /apps
[root@linux-node4 ~]# mv apache-tomcat-7.0.69.zip /apps/
[root@linux-node4 ~]# cd /apps/
[root@linux-node4 apps]# unzip apache-tomcat-7.0.69.zip
[root@linux-node4 apps]# ln -sv /apps/apache-tomcat-7.0.69 /apps/tomcat
‘/apps/tomcat’ -> ‘/apps/apache-tomcat-7.0.69’ ---- 做个软连接
/apps/tomcat/webapps
[root@linux-node4 webapps]# rm -rf ./*
root@linux-node4 webapps]# mkdir test
[root@linux-node4 test]# vim index.html --做个页面
tomcat page
[root@linux-node4 tomcat]# chmod a+x bin/*.sh
[root@linux-node4 tomcat]# ./bin/catalina.sh start
Using CATALINA_BASE: /apps/tomcat
Using CATALINA_HOME: /apps/tomcat
Using CATALINA_TMPDIR: /apps/tomcat/temp
Using JRE_HOME: /usr
Using CLASSPATH: /apps/tomcat/bin/bootstrap.jar:/apps/tomcat/bin/tomcat-juli.

二 替换tomcat日志格式，并且加入到kibana

root@linux-node4 tomcat]# vim conf/server.xml

prefix="tomcat_access_log." suffix=".log"
             pattern="{"clientip":"%h","ClientUser":"%l","authenticated":"%u","AccessTime":"%t","method":"%r","status":"%s","SendBytes":"%b","Query?string":"%q","partner":"%{Referer}i","AgentVersion":"%{User-Agent}i"}"/>

[root@linux-node4 bin]# shutdown
[root@linux-node4 bin]# sh startup.sh
[root@linux-node4 logs]# tail -f catalina.2020-08-20.log
日志进行json验证

把json格式拿去验证下

配置logstash的tomcat配置文件
[root@linux-node4 logs]# vim /etc/logstash/conf.d/tomcat.conf

input {
  file {
    path => "/apps/tomcat/logs/tomcat_access_log.2020-08-20.*.log"
    type => "tomcat-access-log-18"
    start_position => "beginning"
    stat_interval => "2"
    codec => "json"
  }

}

output {
  elasticsearch {
    hosts => ["10.0.0.18:9200"]
    index => "logstash-tomcat-accesslog-18-%{+YYYY.MM.dd}"
    }
    file {
      path => "/tmp/tomcat.txt"
  }
}

[root@linux-node4 logs]# /usr/share/logstash/bin/logstash -f /etc/logstash/co.d/tomcat.conf –t
[root@linux-node4 tmp]# systemctl restart logstash