elk日志使用
elasticsearch +log4net.ElasticSearch+kibana(windows)
- 需要的东西(目前用的5.6版本)
1.先安装jdk和jre 配置java环境
2. 下载elasticsearch ,运行elasticsearch-5.6.16\bin\elasticsearch.bat 启动es,端口默认9200;(执行elasticsearch-service.bat install 设置为windows服务)
3.下载kibana,运行kibana-5.6.16-windows-x86\bin\kibana.bat 启动kibana 端口默认5601;(执行 nssm install kibana,设置kibana路径,设置为windows服务,需要下载nssm)
4.定时删除es索引;删除es索引\deleteIndex\delete.ext程序附加到windows任务计划程序,设置每天跑一次
var url= ConfigurationManager.AppSettings["EsUrl"]; var indexs = ConfigurationManager.AppSettings["EsIndex"]; var day=int.Parse(ConfigurationManager.AppSettings["ESdeleteDay"]); log.Info($"url:{url};索引:{indexs};删除天数:{day}"); var nodes = new Uri(url); var client = new ElasticClient(nodes); var index = indexs.Split(','); var time = DateTime.Now; foreach (var item in index) { var logindex=item+"-"+time.AddDays(day * -1).ToString("yyyy.MM.dd"); var result = client.DeleteIndex(logindex); if (result.ApiCall.Success) { log.Info($"已删除索引:{logindex}"); } }
- 写入日志到es
log4net.ElasticSearch基于log4net,基本无缝对接log4net,只需要更改log4net.config配置即可
<log4net> <root> <level value="All" /> <!--记录到es--> <appender-ref ref="ElasticSearchAppender" /> </root> <appender name="ElasticSearchAppender" type="log4net.ElasticSearch.ElasticSearchAppender, log4net.ElasticSearch"> <layout type="log4net.Layout.PatternLayout,log4net"> <param name="ConversionPattern" value="%d{ABSOLUTE} %-5p %c{1}:%L - %m%n" /> </layout> <connectionString value="Server=localhost;Index=pxin_log;Port=9200;rolling=true"/> <lossy value="false" /> <!-- 相当于缓存池,满10个才写入es--> <bufferSize value="10" /> <evaluator type="log4net.Core.LevelEvaluator"> <!-- 异常级别直接写入es--> <threshold value="ERROR"/> </evaluator> </appender> </root> </log4net>