logback LogstashEncoder elk

    
    
     
        
            
                
                    UTC
                
                
                      
                    
                        {
                        "ip": "${ip}",
                        "app": "${appName}",
                        "level": "%level",
                        "trace": "%X{X-B3-TraceId:-}",
                        "span": "%X{X-B3-SpanId:-}",
                        "parent": "%X{X-B3-ParentSpanId:-}",
                        "thread": "%thread",
                        "class": "%logger{40}",
                        "message": "%message",
                        "stack_trace": "%exception{10}"
                        　　　　　　　　　　　　　}
                    
                
            
        
    

    
        
            
        
    

    
        
            
        
    

 

logstash 配置

input {
   tcp {
     port => 5044
     codec => json_lines
   }


}
filter {
    multiline {
        #pattern => "^%{TIMESTAMP_ISO8601}"
        pattern => "^\s"
      what => "previous"
        }
urldecode{
 field =>message
 }
}
output {
  elasticsearch {
    hosts => ["es:9200"]
  }

}

docker logstash 配置

  logstash:
    image: logstash:6.5.4
    container_name: logstash
    volumes:
      - ./es/logstash/pipeline:/usr/share/logstash/pipeline
      - ./es/logstash/config:/usr/share/logstash/config
    environment:
      - ELASTICSEARCH_URL="http://es:9200"
    networks:
      - javanet
    ports:
      - 5044:5044
      - 9600:9600

参考

https://blog.csdn.net/qq_33430322/article/details/89238944