ELK環境搭建之三Logstash環境安裝及SpringBoot的logback日志內建

一、logstash-7.10.2-linux-x86_64.tar.gz安裝包下載下傳

下載下傳位址：https://www.elastic.co/cn/downloads/past-releases#logstash

二、logstash安裝

1、将包logstash-7.10.2-linux-x86_64.tar.gz上傳至伺服器/data目錄下，解壓

tar xvf logstash-7.10.2-linux-x86_64.tar.gz
cd /data/logstash-7.10.2/config
cp logstash-sample.conf logstash.conf
vi logstash.conf
           

配置關鍵内容

input {
  tcp {
      port => 4560
      codec => json_lines
  }
}
output {
  elasticsearch {
    hosts => ["http://server12:9200","http://server13:9200","http://server14:9200"]
    index => "%{[serverName]}-%{+YYYY.MM.dd}"
    user => "elastic"
    password => "elastic123456"
  }
}

filter {
      date {
         match => ["PARAM_date", "yyyy.MM.dd.HH.mm","UNIX_MS"]
         target => "@timestamp"
       }
      ruby {
         code => "event.set('timestamp', event.get('@timestamp').time.localtime + 8*60*60)"
      }
      ruby {
         code => "event.set('@timestamp',event.get('timestamp'))"
       }
      mutate {
         remove_field => ["timestamp"]
      }
}
           

2、建立啟動腳本，時間長了，指令容易忘記

cd /data/
chown -R es:es logstash-7.10.2
su - es
cd /data/logstash-7.10.2
vi mystart.sh
           

加入配置

啟動

sh mystart.sh
           

3、開放端口4560

三、logback內建

1、加入maven依賴包

<!--logback開始-->
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-classic</artifactId>
                <version>1.2.3</version>
            </dependency>
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-core</artifactId>
                <version>1.2.3</version>
            </dependency>
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-access</artifactId>
                <version>1.2.3</version>
            </dependency>
            <dependency>
                <groupId>net.logstash.log4j</groupId>
                <artifactId>jsonevent-layout</artifactId>
                <version>1.6</version>
            </dependency>
            <dependency>
                <groupId>net.logstash.logback</groupId>
                <artifactId>logstash-logback-encoder</artifactId>
                <version>5.0</version>
            </dependency>
            <!--logback結束-->
           

2、在resources目錄下，新加logback.xml，關鍵配置如下：

<?xml version="1.0" encoding="UTF-8"?>
<configuration debug="false">
    <!--定義日志檔案的存儲位址 勿在 LogBack 的配置中使用相對路徑-->
    <springProperty scope="context" name="logname" source="spring.application.name" />
    <property name="LOG_HOME" value="../logs" />
    <property name="LOG_NAME" value="shop-server" />
    <property name="LOG_NAME" value="shop-server" />
    <!-- 控制台輸出 -->
    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
            <!--格式化輸出：%d表示日期，%thread表示線程名，%-5level：級别從左顯示5個字元寬度%msg：日志消息，%n是換行符-->
            <pattern>[%d{yyyy-MM-dd HH:mm:ss} %-5level %logger{50}%line] %msg%n</pattern>
        </encoder>
    </appender>
    <!-- 按照每天生成日志檔案 -->
    <appender name="FILE"  class="ch.qos.logback.core.rolling.RollingFileAppender">
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <!--日志檔案輸出的檔案名-->
            <FileNamePattern>${LOG_HOME}/log-${LOG_NAME}-%d{yyyy-MM-dd}.log</FileNamePattern>
            <!--日志檔案保留天數-->
            <MaxHistory>30</MaxHistory>
        </rollingPolicy>
        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
            <!--格式化輸出：%d表示日期，%thread表示線程名，%-5level：級别從左顯示5個字元寬度%msg：日志消息，%n是換行符-->
            <pattern>[%d{yyyy-MM-dd HH:mm:ss} %-5level %logger{50}%line] %msg%n</pattern>
        </encoder>
        <!--日志檔案最大的大小-->
        <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
            <MaxFileSize>10MB</MaxFileSize>
        </triggeringPolicy>
    </appender>

    <appender name="LOGSTASH"
              class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>ip位址:4560</destination>
        <!-- encoder必須配置,有多種可選 -->
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder">
            <customFields>{"serverName":"${logname}"}</customFields>
        </encoder>
    </appender>

    <!-- 日志輸出級别 -->
    <root level="INFO">
        <appender-ref ref="STDOUT" />
        <appender-ref ref="LOGSTASH" />
        <appender-ref ref="FILE" />
    </root>
    <!--
    <logger name="org.hibernate.engine.QueryParameters" level="DEBUG"/>
    <logger name="org.hibernate.engine.query.HQLQueryPlan" level="DEBUG"/>
    <logger name="org.hibernate.type.descriptor.sql.BasicBinder" level="TRACE"/>
    -->
</configuration>