elk日志系统搭建

docker拉取镜像

docker pull docker.io/sebp/elk

docker 运行

docker run -dit --name myelk -p 5601:5601 -p 9200:9200 -p 5044:5044 -v /opt/elk-data:/var/lib/elasticsearch -v /etc/localtime:/etc/localtime sebp/elk

  如果上一步启动未成功，查看docker日志出现以下错误

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

  调整服务器虚拟内存空间

sysctl -w vm.max_map_count=262144

  永久生效方法

vim /etc/sysctl.conf

vm.max_map_count=26144

端口说明

elasticsearch 9200
kibana 5601
logstash 5044

进入容器

docker exec -it myelk /bin/bash

安装vim，docker容器中默认没有vi和vim

apt-get update
apt-get install vim

修改logstash配置

vim /etc/logstash/conf.d/02-beats-input.conf

input {
  tcp {
      port => 5044
      codec => json_lines
  }
}

output {
  elasticsearch {
      action => "index"
      # 索引格式
      index => "yiban-%{+YYYY.MM.dd}"
      hosts => ["localhost:9200"]
  }
}

重启容器

docker restart myelk

访问 http://ip:5601

新建springboot项目，引入logstash依赖

<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>5.1</version>
</dependency>

编辑logback-spring.xml日志配置文件

<?xml version="1.0" encoding="UTF-8"?>
<!--该日志将日志级别不同的log信息保存到不同的文件中 -->
<configuration>
    <include resource="org/springframework/boot/logging/logback/defaults.xml" />

    <springProperty scope="context" name="springAppName"
                    source="spring.application.name" />

    <!-- 日志在工程中的输出位置 -->
    <property name="LOG_FILE" value="${BUILD_FOLDER:-build}/${springAppName}" />

    <!-- 控制台的日志输出样式 -->
    <property name="CONSOLE_LOG_PATTERN"
              value="%clr(%d{yyyy-MM-dd HH:mm:ss.SSS}){faint} %clr(${LOG_LEVEL_PATTERN:-%5p}) %clr(${PID:- }){magenta} %clr(---){faint} %clr([%15.15t]){faint} %m%n${LOG_EXCEPTION_CONVERSION_WORD:-%wEx}}" />

    <!-- 控制台输出 -->
    <appender name="console" class="ch.qos.logback.core.ConsoleAppender">
        <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
            <level>INFO</level>
        </filter>
        <!-- 日志输出编码 -->
        <encoder>
            <pattern>${CONSOLE_LOG_PATTERN}</pattern>
            <charset>utf8</charset>
        </encoder>
    </appender>

    <!-- 为logstash输出的JSON格式的Appender -->
    <appender name="logstash"
              class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>39.97.225.133:5044</destination>
        <!-- 日志输出编码 -->
        <encoder
                class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <providers>
                <timestamp>
                    <timeZone>UTC</timeZone>
                </timestamp>
                <pattern>
                    <pattern>
                        {
                        "logLevel": "%level",
                        "service": "${springAppName:-}",
                        "pid": "${PID:-}",
                        "thread": "%thread",
                        "class": "%logger{40}",
                        "rest": "%message"
                        }
                    </pattern>
                </pattern>
            </providers>
        </encoder>
    </appender>

    <!-- 日志输出级别 -->
    <root level="INFO">
        <appender-ref ref="console" />
        <appender-ref ref="logstash" />
    </root>
</configuration>