springBoot整合ELK

ELK环境构建: 版本:6.3.2

集群:四个节点

es配置

cluster.name: escluster
node.name: es1
node.master: true
node.data: true
path.data: /data/elasticsearch/data
path.logs: /data/elasticsearch/logs
bootstrap.memory_lock: true
bootstrap.system_call_filter: false
http.port: 9200
network.host: 0.0.0.0
discovery.zen.minimum_master_nodes: 2
discovery.zen.ping_timeout: 3s
discovery.zen.ping.unicast.hosts: ["172.16.0.8:9300","172.16.0.6:9300","172.16.0.22:9300"]
http.cors.enabled: true
http.cors.allow-origin: "*"

linux系统参数:

第一步：
vim jvm.options
将
-Xms1g
-Xmx1g
改为
-Xms512m
-Xmx512m
第二步：
在/etc/sysctl.conf添加如下内容
fs.file-max=655360
vm.max_map_count=655360
sysctl -p生效

第三步:
修改vim /etc/security/limits.conf

* soft nofile 65536
* hard nofile 65536
* soft nproc 65536
* hard nproc 65536
* soft memlock unlimited
* hard memlock unlimited

Kibana配置

server.port: 5601
server.host: "192.168.176.111"
server.name: "Kibana"
elasticsearch.url: "http://192.168.176.111:9200"         #把老版本的url换成hosts
elasticsearch.preserveHost: true
kibana.index: ".kibana"
logging.verbose: true

logStash简单配置

input{
        tcp {
                host => "192.168.176.111"
                port => 4560
                codec => json_lines
        }
}
output{
        elasticsearch{
                hosts=>["192.168.176.111:9200"]
                index => "xiaoxianglog"
                }
        stdout{codec => rubydebug}
}

logback-spring.xml配置

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <springProperty scope="context" name="LOG_HOME" source="app.name"/>
    <!--
    <include resource="org/springframework/boot/logging/logback/base.xml" />
    -->
    <appender name="console" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <!--多环境配置-->
            <springProfile name="prod">
                <pattern>
                    %d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %highlight(%-5level) %cyan(%logger{50}) - %highlight(%msg) %n
                </pattern>
            </springProfile>

            <springProfile name="!prod">
                <pattern>
                    %d{yyyy-MM-dd HH:mm:ss.SSS}--> [%thread] ----%highlight(%-5level)--- %cyan(%logger{50}) -
                    %highlight(%msg) %n
                </pattern>
            </springProfile>

            <charset>UTF-8</charset>
        </encoder>
        <!-- only log lvel DEBUG and above -->
        <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
            <level>DEBUG</level>
        </filter>
    </appender>

    <appender name="rollingInfoFile" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
            <fileNamePattern>/var/logs/${LOG_HOME}/info.%d{yyyy-MM-dd}.%i.log</fileNamePattern>
            <!--
            <fileNamePattern>${catalina.base}/logs/${LOG_HOME}/%d{yyyy-MM-dd}.%i.log</fileNamePattern>
            -->
            <!-- 单个日志文件最多 100MB, 60天的日志周期，最大不能超过20GB -->
            <maxFileSize>100MB</maxFileSize>
            <maxHistory>60</maxHistory>
            <totalSizeCap>20GB</totalSizeCap>
        </rollingPolicy>
        <encoder>
            <pattern>%date{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
            <charset>UTF-8</charset>
        </encoder>
        <filter class="ch.qos.logback.classic.filter.LevelFilter">
            <level>ERROR</level>
            <onMatch>DENY</onMatch>
            <onMismatch>ACCEPT</onMismatch>
        </filter>
        <!-- Safely log to the same file from multiple JVMs. Degrades performance! -->
        <prudent>true</prudent>
    </appender>

    <appender name="rollingErrorFile" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
            <fileNamePattern>/var/logs/${LOG_HOME}/error.%d{yyyy-MM-dd}.%i.log</fileNamePattern>
            <!--
            <fileNamePattern>${catalina.base}/logs/${LOG_HOME}/%d{yyyy-MM-dd}.%i.log</fileNamePattern>
            -->
            <!-- 单个日志文件最多 100MB, 60天的日志周期，最大不能超过20GB -->
            <maxFileSize>100MB</maxFileSize>
            <maxHistory>60</maxHistory>
            <totalSizeCap>20GB</totalSizeCap>
        </rollingPolicy>
        <encoder>
            <pattern>%date{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
            <charset>UTF-8</charset>
        </encoder>
        <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
            <level>ERROR</level>
        </filter>
        <!-- Safely log to the same file from multiple JVMs. Degrades performance! -->
        <prudent>true</prudent>
    </appender>


    <!-- project default level 项目中默认的日志级别 -->
    <logger name="com.xiaoxiang.crm" level="ERROR"/>
    <logger name="org.springframework" level="DEBUG"/>
    <logger name="org.mybatis" level="ERROR"/>


    <!--log4jdbc -->
    <logger name="jdbc.connection" level="OFF"/>
    <logger name="jdbc.resultset" level="OFF"/>
    <logger name="jdbc.audit" level="OFF"/>
    <logger name="jdbc.sqlonly" level="OFF"/>
    <logger name="jdbc.sqltiming" level="OFF"/>

    <!--     logStash配置-->
    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <!--配置logStash 服务地址-->
        <destination>192.168.176.111:4560</destination>
        <!-- 日志输出编码 -->
        <encoder charset="UTF-8"
                 class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <providers>
                <timestamp>
                    <timeZone>Asia/Shanghai</timeZone>
                </timestamp>
                <pattern>
                    <pattern>
                        { "logLevel": "%level", "serviceName": "${springAppName:-}", "pid": "${PID:-}", "thread":
                        "%thread", "class": "%logger{40}", "rest": "%message" }
                    </pattern>
                </pattern>
            </providers>
        </encoder>
    </appender>


    <root level="DEBUG">
        <appender-ref ref="console"/>
        <appender-ref ref="rollingInfoFile"/>
        <appender-ref ref="rollingErrorFile"/>
        <appender-ref ref="LOGSTASH"/>
    </root>

</configuration>