log4j2整合ELK搭建实时日志平台
一、springboot的默认日志框架logback换成log4j2
1.剔除logback(dependencies里的第一个dependency的exclusion)和引入log4j2的pom依赖
<!--这个starter-web肩负着剔除logback的重任,一定要放在第一个位置-->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<!--去掉springboot自带的logback日志框架,因为项目要用log4j2框架-->
<exclusions>
<exclusion>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-logging</artifactId>
</exclusion>
</exclusions>
</dependency>
<!--添加log4j2相关jar包-->
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.7</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.7</version>
</dependency>
2.配置log4j2.xml和引入到项目
<?xml version="1.0" encoding="UTF-8"?>
<Configuration>
<Properties>
<Property name="LOG_PATTERN">{"logger": "%logger", "level": "%level", "msg": "%message"}%n</Property>
</Properties>
<Appenders>
<Console name="Console" target="SYSTEM_OUT" follow="true">
<PatternLayout pattern="${LOG_PATTERN}"/>
</Console>
<Socket name="logstash" host="logstash服务器IP地址" port="自定义端口" protocol="TCP">
<PatternLayout pattern="${LOG_PATTERN}"/>
</Socket>
</Appenders>
<Loggers>
<Root level="INFO">
<AppenderRef ref="Console"/>
<AppenderRef ref="logstash-tcp" />
</Root>
</Loggers>
</Configuration>
3.在application.yml里引入配置
#指定log4j2的路径
logging:
config:
classpath:
log4j2.xml
4.在代码中使用
//引入
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
public class MyClass{
private static final Logger logger = LogManager.getLogger(CarController.class);
public void myMethod(){
logger.error("error occurs here!");
}
}
二、ELK
ELK是Logstash+ElasticSearch+Kibana,其中,Logstash负责收集日志,ElasticSearch负责存储日志,而Kibana提供界面查看日志信息。
本文讲述如何将Logstash与Log4j2进行连接,如需整体搭建,请联系Q2298750363
首先进行安装Logstash(本文以6.3.2版本为例)
tar -zxvf logstash-6.3.2.tar.gz
随后进入Logstash根目录,并创建conf文件目录
cd logstash-6.3.2
mkdir conf
添加Logstash配置文件
vim ./conf/logstash.conf
配置内容如下:
input {
tcp {
port => 与Log4j2中对应的端口
codec => json
}
}
output {
elasticsearch {
hosts => "elasticsearch的ip和端口号"
index => "es-message-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug }
}
启动logstash
./bin/logstash -f ./conf/logstash.conf
使用netstat -tlunp查看9600端口是否启动成功:
打开web页面,并添加索引,可以看到已经可以监测到实时的日志