最近在做后台项目改造,将原来的项目变成springCloud微服务架构的。其中做了elk日志收集,人手有限没有用到异步消息,filebeat之类的,先做个低配的吧。直接log4j2将日志扔到logstash里面去,大体配置如下:
<Appenders> <!--这个输出控制台的配置--> <Console name="Console" target="SYSTEM_OUT"> <!--控制台只输出level及其以上级别的信息(onMatch),其他的直接拒绝(onMismatch)--> <ThresholdFilter level="debug" onMatch="ACCEPT" onMismatch="DENY"/> <PatternLayout pattern="${log.pattern}"/> </Console> <Socket name="Logstash_client" host="xxx.xxx.xxx.xx" port="1560" protocol="TCP"> <PatternLayout pattern="${PATTERN}" /> </Socket> <Socket name="Logstash_edit" host="xxx.xxx.xxx.xx" port="1561" protocol="TCP"> <PatternLayout pattern="${PATTERN}" /> </Socket> </Appenders> <!--然后定义logger,只有定义了logger并引入的appender,appender才会生效--> <Loggers> <Logger name="client_log" level="debug"> <AppenderRef ref="Logstash_client"/> <AppenderRef ref="Console"/> </Logger> <Logger name="edit_log" level="debug" additivity="false"> <AppenderRef ref="Logstash_edit"/> <AppenderRef ref="Console"/> </Logger> </Loggers>
logstash那边的配置tcp接收
- input {
- tcp{
- port => 1560
- }
- tcp{
- port => 1561
- }
- }
java里面调用:
//编辑后台的logger Logger logger_edit= LogManager.getLogger("edit_log"); //客户端的logger Logger logger_client= LogManager.getLogger("client_log");
ok,可以接收到。
可是有个问题,logstash重启之后,就接收不到日志了,除非log4j2程序重启才可以,这不行啊,线上环境岂能随便重启。百度谷歌群里大咖一通问,找到办法了。不适用socket长连接甩日志了,改用gelf就可以,基本配置:
pom:
<dependency> <groupId>biz.paluch.logging</groupId> <artifactId>logstash-gelf</artifactId> <version>1.11.1</version> </dependency>
log4j2:
<Gelf name="Logstash_client" host="udp:ip地址" port="1560" version="1.1" extractStackTrace="true" filterStackTrace="true" mdcProfiling="true" includeFullMdc="true" maximumMessageSize="8192" originHost="%host{fqdn}" additionalFieldTypes="fieldName1=String,fieldName2=Double,fieldName3=Long"> <Field name="level" pattern="%level" /> <Field name="message" pattern="%message" /> </Gelf> <Gelf name="Logstash_edit" host="udp:ip地址" port="1561" version="1.1" extractStackTrace="true" filterStackTrace="true" mdcProfiling="true" includeFullMdc="true" maximumMessageSize="8192" originHost="%host{fqdn}" additionalFieldTypes="fieldName1=String,fieldName2=Double,fieldName3=Long"> <Field name="level" pattern="%level" /> <Field name="message" pattern="%message" /> </Gelf> <!--<Socket name="Logstash_client" host="222.175.121.252" port="1560" protocol="TCP"> <PatternLayout pattern="${PATTERN}" /> </Socket> <Socket name="Logstash_edit" host="222.175.121.252" port="1561" protocol="TCP"> <PatternLayout pattern="${PATTERN}" /> </Socket>--> </Appenders> <!--然后定义logger,只有定义了logger并引入的appender,appender才会生效--> <Loggers> <Logger name="client_log" level="debug"> <!--<AppenderRef ref="Logstash_client"/>--> <AppenderRef ref="Console"/> </Logger> <Logger name="edit_log" level="debug"> <!--<AppenderRef ref="Logstash_edit"/>--> <AppenderRef ref="Console"/> </Logger> <AsyncRoot level="debug"> <!-- 这儿为trace表示什么都可以打印出来了,其他几个级别分别为:TRACE、DEBUG、INFO、WARN、ERROR和FATAL --> <AppenderRef ref="Console"/> </AsyncRoot> </Loggers>
logstash:
input{
gelf {
port => 1561
tags => ["cms_log"]
codec => "json"
}
gelf {
port => 1560
tags => ["client_log"]
codec => "json"
}
stdin{}
}
filter {
date {
match => [ "timeMillis", "UNIX_MS" ]
}
json {
source => "message"
remove_field => ["short_message","facility","host","message"]
}
if "cms_log" in [tags] {
geoip {
source => "ip"
}
}
}
java程序调用方法一样,ok这样重启一下logstash,应用程序就不互相影响了。不过貌似要想更好的使用还得需要加异步消息缓冲储存,以后再研究吧~