logstash grok详解 logstash收集springboot日志

logstash收集springboot日志maven依赖<dependency><groupId>net.logstash.logback</groupId><artifactId>logstash-logback-encoder</artifactId><version>5.1</version></dependency>springboot 配置文件logging:config: classpath:logback.xmllogback.xml<?xml version="1.0" encoding="UTF-8"?><configuration> <include resource="org/springframework/boot/logging/logback/base.xml" />   <property name="LOG_HOME" value="https://tazarkount.com/read/logs/spring.log" />  <property name="APP_NAME" value="https://tazarkount.com/read/log" />  <property name="LOG_MAX_HISTORY" value="https://tazarkount.com/read/30" />   <property name="LOG_APP_HOME" value="https://tazarkount.com/read/${APP_NAME}/%d{yyyy-MM-dd}" />   <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender"><encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder"><pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{50} - %msg%n</pattern></encoder> </appender>  <appender name="APP"class="ch.qos.logback.core.rolling.RollingFileAppender"><rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy"><FileNamePattern>${LOG_APP_HOME}/base.%d{yyyy-MM-dd}.log</FileNamePattern><MaxHistory>${LOG_MAX_HISTORY}</MaxHistory></rollingPolicy><encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder"><pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{500} - %msg%n</pattern></encoder> </appender>  <logger name="org.springframework"><level value="https://tazarkount.com/read/WARN" /> </logger> <logger name="org.apache.shiro"><level value="https://tazarkount.com/read/WARN" /> </logger> <logger name="freemarker"><level value="https://tazarkount.com/read/WARN" /> </logger> <logger name="org.hibernate"><level value="https://tazarkount.com/read/WARN" /> </logger> <logger name="org.hibernate.SQL"><level value="https://tazarkount.com/read/DEBUG" /> </logger> <logger name="org.apache.ibatis"><level value="https://tazarkount.com/read/DEBUG" /> </logger> <logger name="org.mybatis.spring"><level value="https://tazarkount.com/read/DEBUG" /> </logger> <logger name="com.alibaba.druid"><level value="https://tazarkount.com/read/DEBUG,INFO" /> </logger><logger name="com.bart.elk"><level value="https://tazarkount.com/read/DEBUG" /> </logger>  <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender"><destination>localhost:4567</destination><encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder" /></appender> <root level="warn,info,debug"><appender-ref ref="APP" /><appender-ref ref="STDOUT" /><appender-ref ref="LOGSTASH" /><appender-ref ref="CONSOLE" /> </root></configuration>logstashspringboot-log.conf
# 文档 # https://www.elastic.co/guide/en/logstash/5.6/input-plugins.html# https://www.elastic.co/guide/en/logstash/6.1/input-plugins.htmlinput{ tcp {mode => "server"host => "0.0.0.0"port => 4567codec => json_lines }}output{# 为了模拟测试就先不放es了，在控制台输出测试看看 #elasticsearch{ #hosts=>["127.0.0.1:9200"] #index => "springboot-elk-%{+YYYY.MM.dd}"#} stdout{codec => rubydebug }}测试接口import java.time.LocalDateTime;import java.time.format.DateTimeFormatter;import javax.servlet.http.HttpServletRequest;import org.slf4j.Logger;import org.slf4j.LoggerFactory;import org.springframework.web.bind.annotation.GetMapping;import org.springframework.web.bind.annotation.RestController;import org.springframework.web.context.request.RequestContextHolder;import org.springframework.web.context.request.ServletRequestAttributes;@RestControllerpublic class ApiTests { protected final static Logger log = LoggerFactory.getLogger(ApiTests.class);@GetMapping("/api/log") public Object log() {ServletRequestAttributes requestAttributes = (ServletRequestAttributes)RequestContextHolder.getRequestAttributes();HttpServletRequest request = requestAttributes.getRequest();String ip = request.getRemoteAddr();String uri = request.getRequestURI();String logStr = String.format("IP=[%s] send request URI = [%s]", ip, uri);log.debug("[debug] "+logStr);log.info("[info] "+logStr);log.warn("[warn] "+logStr);log.error("[error] "+logStr);return "ok : "+ LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss")); } }测试效果先运行logstash
# linux: bin/logstash -f config/springboot-log.conf# windows: bin\logstash.bat -f config/springboot-log.conf在运行springboot项目，然后调用测试接口：http://localhost:8080/api/log
观察logstash控制台输出：
{"@timestamp" => 2021-04-28T15:40:43.182Z,"level" => "DEBUG","port" => 57778,"thread_name" => "http-nio-8080-exec-1","level_value" => 10000,"@version" => "1","host" => "127.0.0.1","logger_name" => "com.bart.elk.ApiTests","message" => "[debug] IP=[127.0.0.1] send request URI = [/api/log]"}{"@timestamp" => 2021-04-28T15:40:43.182Z,"level" => "INFO","port" => 57778,"thread_name" => "http-nio-8080-exec-1","level_value" => 20000,"@version" => "1","host" => "127.0.0.1","logger_name" => "com.bart.elk.ApiTests","message" => "[info] IP=[127.0.0.1] send request URI = [/api/log]"}{"@timestamp" => 2021-04-28T15:40:43.183Z,"level" => "WARN","port" => 57778,"thread_name" => "http-nio-8080-exec-1","level_value" => 30000,"@version" => "1","host" => "127.0.0.1","logger_name" => "com.bart.elk.ApiTests","message" => "[warn] IP=[127.0.0.1] send request URI = [/api/log]"}{"@timestamp" => 2021-04-28T15:40:43.183Z,"level" => "ERROR","port" => 57778,"thread_name" => "http-nio-8080-exec-1","level_value" => 40000,"@version" => "1","host" => "127.0.0.1","logger_name" => "com.bart.elk.ApiTests","message" => "[error] IP=[127.0.0.1] send request URI = [/api/log]"}【logstash grok详解 logstash收集springboot日志】说明运行成功！
参考说明：
logstash-logback-encoder
参考博客-1
参考博客-2
logstash 文档