ELK日志分析平台-logstash搭建手册(SpringBoot)

1.logstash

1.各分布式项目下创建logback-logstash.xml配置文件

    

    
    

    
    

    
        ${logstashService}
        1048576
        
    

    
    
        ${logstashService}
        1048576
        
        
            
                
                    UTC
                
                
                    
                        {
                        "severity": "%level",
                        "service": "${springAppName:-}",
                        "trace": "%X{X-B3-TraceId:-}",
                        "span": "%X{X-B3-SpanId:-}",
                        "exportable": "%X{X-Span-Export:-}",
                        "pid": "${PID:-}",
                        "thread": "%thread",
                        "class": "%logger{40}",
                        "rest": "%message"
                        }
                    
                
            
        
    

    
        
        
    

boostrap.yml添加xml配置的logstashService服务器地址+端口

logstash:
  service: 192.168.11.44:9600

2.linux logstash安装服务器

/etc/logstash/logstash.conf 文件配置

input {
    tcp {
        mode => "server"
        host => "0.0.0.0"
        port => 9600
        codec => json
    }
}

 filter {
    grok {
        match => {
            "message" => "%{TIMESTAMP_IOS08601:timestamp}+%{LOGLEVEL:severity}+[%DATA:service],%{DATA:trace},%{DATA:span},%{DATA:exporttable}]+%{DATA:pid}---+[%{DATA:thread}]+%{DATA:class}+:+%{GREEDYDATA:rest}"
            }
        }
    }

output {
    elasticsearch { 
    hosts => "192.168.11.32:9200"
    index => "serverlog-11.41-%{+YYYY.MM.dd}"
    }
}

运行logstash

/usr/share/logstash/bin/./logstash -f /etc/logstash/logstash.conf >/dev/null &

2.Elasticsearch

3.kibana

配置上logstash conf中的serverlog* 即可查看到对应的log

image.png