Logstash+Logback日志收集

日志客户端配置

添加Maven依赖

    com.cwbase
    logback-redis-appender
    
        
            redis.clients
            jedis
        
    

配置logback.xml

    
    woo-erp
    
    119.119.23.35
    
    6039
    
    Ht123123123
    
    logstash
    true
    true
    15
    
    


    




    
    

Logstash服务端配置

创建文件redis_input.conf放在conf.d目录下

input {
    # 从redis读取日志
    redis{
        data_type => "list"
        key => "logstash"
        host => "119.119.23.35"
        port => "6039"
        password => "Ht123123123"
        db => 15
        threads => 5
    }
}

输出到ES示例

创建文件es-output.conf放在conf.d目录下

output {
        elasticsearch {
                hosts => ["http://localhost:9200"]
                index => "%{source}_index_%{+YYYY.MM}"
                template => "/etc/logstash/conf.d/logstash_template.json"
                template_name => "logstash_template"
                template_overwrite => true
                user => "elastic"
                # password => "1qaz@WSX3edc"
                pool_max => 500
                pool_max_per_route => 2000
                retry_initial_interval => 4
                retry_max_interval => 16
        }
}

logstash_template.json示例

{
    "template": "default_template",
    "order": 1,
    "settings": {
        "index.number_of_shards": 5,
        "number_of_replicas": 0
    },
    "mappings": {
        "_default_": {
            "_all": {
                "enabled": true,
                "omit_norms": true
            },
            "dynamic_templates": [
                {
                    "message_field": {
                        "match": "message",
                        "match_mapping_type": "string",
                        "mapping": {
                            "type": "string",
                            "index": "analyzed",
                            "omit_norms": true,
                            "fielddata": {
                                "format": "disabled"
                            }
                        }
                    }
                },
                {
                    "number_fields": {
                        "match": "*",
                        "match_mapping_type": "integer",
                        "mapping": {
                            "type": "integer",
                            "index": "not_analyzed",
                            "doc_values": true
                        }
                    }
                },
                {
                    "string_fields": {
                        "match": "*",
                        "match_mapping_type": "string",
                        "mapping": {
                            "type": "string",
                            "index": "not_analyzed",
                            "doc_values": true
                        }
                    }
                }
            ]
        }
    }
}