【ELK】搭建elk日志平台（使用docker-compose），并接入springboot项目

1、环境搭建

前提条件：请自行安装docker以及docker-compose环境

version: '3'
services:elasticsearch:image: elasticsearch:7.14.0container_name: elasticsearchports:- "9200:9200"- "9300:9300"environment:# 以单一节点模式启动discovery.type: single-nodeES_JAVA_OPTS: "-Xms512m -Xmx512m"kibana:image: kibana:7.14.0container_name: kibanaenvironment:I18N_LOCALE: zh-CNELASTICSEARCH_HOSTS: http://elasticsearch:9200ports:- 5601:5601logstash:image: logstash:7.14.0container_name: logstashports:- 4560:4560- 9600:9600privileged: trueenvironment:- TZ=Asia/Shanghaivolumes:- ./logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf #挂载logstash的配置文件depends_on:- elasticsearchlinks:- elasticsearch:es #可以用es这个域名访问elasticsearch服务

其中：logstash.conf配置文件如下：

input {tcp {#模式选择为servermode => "server"#ip和端口根据自己情况填写，端口默认4560host => "0.0.0.0"port => 4560#格式jsoncodec => json_lines
}
}output {elasticsearch {action => "index"#这里是es的地址，多个es要写成数组的形式hosts  => "127.0.0.1:9200"#用于kibana过滤，可以填项目名称index  => "app-logstash-%{+YYYY.MM.dd}"
}
stdout {codec => rubydebug
}
}

2、用法

首先，引入pom

  <!--集成logstash--><dependency><groupId>net.logstash.logback</groupId><artifactId>logstash-logback-encoder</artifactId><version>6.6</version></dependency>

其次，在logback.xml添加如下信息：

  <appender name="stash" class="net.logstash.logback.appender.LogstashTcpSocketAppender"><!--  这是是logstash服务器地址 端口--><destination>127.0.0.1:4560</destination><!--输出的格式，推荐使用这个--><encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder"><providers><timestamp><timeZone>Asia/Shanghai</timeZone></timestamp><!--自定义日志输出格式--><pattern><pattern>{"project": "app-java-logstash","level": "%level","service": "${APP_NAME:-}","class": "%logger","message": "[%X{sessionId}] [%X{traceId}] %class:%line %message","thread": "%thread","classLine":"%class:%line"}</pattern></pattern></providers></encoder></appender><root level="info"><appender-ref ref="stash"/></root>