springboot集成elk日志收集示例

环境

elasticsearch-6.3.2.tar.gz

logstash-6.0.0.tar.gz

kibana-6.2.4-linux-x86_64.tar.gz

1.安装logstash,Elasticsearch,Kibana

1.1.启动Elasticsearch

**注意：elasticsearch不能以root运行 **

1）根据需要修改ip和端口（默认9200）：vim config/elasticsearch.yml（#network.host: 192.168.0.1
那一行）
2）后台启动：
nohup ./bin/elasticsearch >>elast_start.out 2>&1 &

访问测试：http://192.168.159.142:9200/
或者curl 192.168.159.142:9200
3）创建索引（索引只能是小写）
curl -XPUT '192.168.159.142:9200/springboot-elk-application?pretty'
查询索引：curl '192.168.159.142:9200/_cat/indices?v'
查询索引+类型的数据：
curl -XGET '192.168.159.142:9200/springboot-elk-application/doc/FwasymkBlfZm11H1HPvi?pretty'

1.2.启动logstash

logstash-6.0.0/config下的配置文件如logstash-sample.conf中指定els的地址

input {
    tcp {
        port => 4560
        codec => json_lines
    }
}
output{
  elasticsearch { 
     hosts => ["192.168.159.142:9200"] 
     index => "springboot-elk-application"
  }
}

后台启动logstash

nohup ./bin/logstash -f config/logstash-sample.conf >>logstash_start.out 2>&1 &

1.3.启动Kibana

kibana-6.2.4-linux-x86_64/config/kibana.yml中指定els地址

elasticsearch.url: "http://192.168.159.142:9200"

后台启动：

nohup ./bin/kibana >>kibana_start.out 2>&1 &
访问测试：http://192.168.159.142:5601

2.springboot工程

logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration scan="true" scanPeriod="60 seconds" debug="false">
	<consolePlugin />
	<property name="APP_NAME" value="springboot-elk" />
	<!-- 这里配置log路径 -->
	<property name="LOG_DIR" value="${user.home}/logs/test/${APP_NAME}" />
	<contextName>${APP_NAME}</contextName>
	<appender name="FILE"
		class="ch.qos.logback.core.rolling.RollingFileAppender">
		<rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
			<fileNamePattern>${LOG_DIR}_%d{yyyy-MM-dd}.log
			</fileNamePattern>
			<maxHistory>30</maxHistory>
		</rollingPolicy>
		<encoder>
			<pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{100}
				- %msg%n
			</pattern>
			<charset class="java.nio.charset.Charset">UTF-8</charset>
		</encoder>
	</appender>
	<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
		<encoder>
			<pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level
				%logger{36}-%msg%n</pattern>
			<charset class="java.nio.charset.Charset">UTF-8</charset>
		</encoder>
	</appender>
	<appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
		<destination>192.168.159.142:4560</destination>
		<encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder" />
	</appender>

	<include resource="org/springframework/boot/logging/logback/base.xml"/>
	<root level="INFO">
		<appender-ref ref="STDOUT" />
		<appender-ref ref="FILE" />
		<appender-ref ref="LOGSTASH" />
	</root>
</configuration>  

3.测试

访问springboot接口如http://localhost:8090/springboot-elk/test
索引信息：

查询索引（_index）+类型(_type)+id(_id)的内容
访问kibana：http://192.168.159.142:5601

创建Index Patterns

Discovery查看日志：