logback输入日志到logstash

本是古典何须时尚 2021-09-01 06:22 863阅读 0赞

logback输入日志到logstash的方法  
1.配置logstash-6.5.0中的logstash.conf文件  
增加tcp模块，注意开放端口,格式必须为json

# Sample Logstash configuration for creating a simple
    # Beats -> Logstash -> Elasticsearch pi
    input {
                file {
                        path => "/home/emeet/apache-tomcat-9.0.16/logs/tomcat_access_log*.log"
                        start_position => "beginning" #从文件开始处读写
    		    type => "tomcat-access-log"
                }
    	    file {
           		path => "/usr//local/nginx18/logs/access_json.log"
           		codec => json
           		start_position => "beginning"
           		type => "nginx-log"
       	     }
    	      tcp {
    		port => 8065
    		codec => "json"
    		type => "usermanagement-log"
    		}
        #       stdin {}  #可以从标准输入读数据
        }
     
        # 输出到本机的 ES
        output {
    	if [type] == "nginx-log"{
            	elasticsearch {
               		hosts => ["127.0.0.1:9200"]
               		index => "nginx-log-%{+YYYY.MM.dd}"
            	}
    	}
    	if [type] == "tomcat-access-log"{
    
            	elasticsearch {
                    	hosts => [ "127.0.0.1:9200"]
      			index => "tomcat-access-log-%{+YYYY.MM.dd}"
            	}
    	}    
    	if [type] == "usermanagement-log"{
    
                    elasticsearch {
                            hosts => [ "127.0.0.1:9200"]
                            index => "usermanagement-log-%{+YYYY.MM.dd}"
                    }
            }
    
        }

重新启动logstash  
2.配置spring-boot  
pom.xml中添加：

<dependency>
    	<groupId>net.logstash.logback</groupId>
    	<artifactId>logstash-logback-encoder</artifactId>
    	<version>4.11</version>
    </dependency>

配置logback-spring-prod.xml  
添加一个appender

<appender name="LOGSTASH"
    	class="net.logstash.logback.appender.LogstashTcpSocketAppender">
    	<destination>111.222.333.444:8065</destination>
    	
    	<encoder charset="UTF-8"
    		class="net.logstash.logback.encoder.LogstashEncoder">
    		<customFields>{"appname":"testlog", "message": "%msg"}</customFields>
    	</encoder>
    </appender>

为了日志不是断行的，加上"message": “%msg”，一个异常信息就会在一条记录中了  
也可以类似下面这种：

<encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
                <providers>
                    <pattern>
                        <pattern>
                            
                            {
                            
                            "indexname":"test_logstash",
                            
                            "appname":"${spring.application.name}",
                            
                            "host": "%ip",
                            
                            "port": "${spring.application.index}",
                            
                            "timestamp": "%d{yyyy-MM-dd HH:mm:ss.SSS}",
                            
                            "thread": "%thread",
                            
                            "level": "%level",
                            
                            "logger_name": "%logger",
                            
                            "message": "%msg",
                            
                            "stack_trace": "%exception"
                            }
                        </pattern>
                    </pattern>
                </providers>
            </encoder>
    
     <encoder class="net.logstash.logback.encoder.LogstashEncoder">
                <throwableConverter class="net.logstash.logback.stacktrace.ShortenedThrowableConverter">
                    
                    <exclude>sun\.reflect\..*\.invoke.*</exclude>
                    <exclude>net\.sf\.cglib\.proxy\.MethodProxy\.invoke</exclude>
                    <exclude>org.*</exclude>
                    <rootCauseFirst>true</rootCauseFirst>
                </throwableConverter>
            </encoder>

再加上输出即可