docker搭建elk日志收集系统

系统日志是开发和调试的重要参考依据,线上的日志查询起来比较繁琐,很耗时间,使用elk方便搞定日志!!!

1. docker 配置

使用docker快速搭建elk日志收集系统,免去繁琐安装,下面直接看配置:

docker-compose

version: '3'
services:
  elasticsearch:
    image: es-ik:6.6.2
    container_name: elasticsearch
    restart: always
    environment:
      - "cluster.name=elasticsearch"
      - "discovery.type=single-node"
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ports:
    - 9200:9200
    - 9300:9300
  kibana:
    image: docker.elastic.co/kibana/kibana:6.6.2
    container_name: kibana
    environment:
      - SERVER_NAME=kibana
      - ELASTICSEARCH_URL=http://elasticsearch:9200
      - XPACK_MONITORING_ENABLED=true
    ports:
      - 5601:5601
    depends_on:
      - elasticsearch
  logstash:
    image: logstash:6.6.2
    container_name: logstash
    volumes:
      - ~/docker/mydata/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
    depends_on:
      - elasticsearch
    links:
      - elasticsearch:es
    ports:
      - 4560:4560

---

说明!!! es-ik:6.6.2是自己创建的镜像,步骤: 创建带ik插件镜像

3个容器分别是:

1. elasticsearch 建立索引
2. kibana 数据可视化
3. logstash 数据收集

这三个组件首字母,简称就是ELK,没什么可说的. docker-compose配置不复杂,不是本篇博客的重点,略过...

logstash.conf

input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4560
    codec => json_lines
    type => "business"
  }
}
output {
  elasticsearch {
    hosts => ["es:9200"]
    action => "index"
    codec => json
    index => "%{type}-%{+YYYY.MM.dd}"
    template_name => "business"
  }
}

上面docker-compose配置中,logstash有一个挂载文件,用来配置logstash. 定义输入输出规则,采用json数据输出.

启动docker容器之前,先创建~/docker/mydata/logstash/logstash.conf文件,否则则启动会有问题.

启动容器

启动命令:
docker-compose up -d

查看docker进程,格式化输出:
docker ps --format "table {{.ID}}\t{{.Names}}\t{{.Ports}}"

Logstash安装json_lines插件

1. 进入logstash容器
   docker exec -it logstash /bin/bash
2. 安装插件
   docker exec -it logstash /bin/bash

安装完成后,访问: ip:5601 即可看到kibana界面

2. logback配置

使用springboot集成方式实现日志收集,没有使用日志监听

logstash依赖

<!--    集成logstash    -->
<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>5.3</version>
</dependency>

logback-spring.xml

通过logback-spring.xml指定日志输出,在配置文件中添加日志输出到logstash,完整配置:

<?xml version="1.0" encoding="UTF-8" ?>
<configuration>
    <!--应用名称-->
    <springProperty scope="context" name="APP_NAME" source="spring.application.name" defaultValue="springBoot"/>
    <!--LogStash访问host-->
    <springProperty name="LOG_STASH_HOST" scope="context" source="logstash.host" defaultValue="localhost"/>
    <!-- 控制台输出日志 -->
    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%X{traceId}] [%level] [%c:%L] - %msg%n</pattern>
        </encoder>
    </appender>
    <!--每天生成一个日志文件，保存30天的日志文件。-->
    <appender name="DayFile" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <File>logs/log.log</File>
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>logs/log.%d{yyyy-MM-dd}.log</fileNamePattern>
            <maxHistory>30</maxHistory>
        </rollingPolicy>
        <encoder>
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%X{traceId}] [%level] [%thread] [%c:%L] - %msg%n</pattern>
        </encoder>
    </appender>

    <!--业务日志输出到LogStash-->
    <appender name="LOG_STASH_BUSINESS" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>${LOG_STASH_HOST}:4560</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <providers>
                <timestamp>
                    <timeZone>Asia/Shanghai</timeZone>
                </timestamp>
                <!--自定义日志输出格式-->
                <pattern>
                    <pattern>
                        {
                        "service": "${APP_NAME:-}",
                        "level": "%level",
                        "pid": "${PID:-}",
                        "thread": "%thread",
                        "class": "%logger",
                        "traceId": "%X{traceId:-}",
                        "message": "%message",
                        "stack_trace": "%exception"
                        }
                    </pattern>
                </pattern>
            </providers>
        </encoder>
    </appender>

    <!--指定logger name为包名或类全名 指定级别 additivity设置是否传递到root logger -->
    <logger name="slf4j" level="INFO" additivity="false">
        <appender-ref ref="STDOUT"/>
        <appender-ref ref="DayFile"/>
        <appender-ref ref="LOG_STASH_BUSINESS"/>
    </logger>
    <!--slf4j2包下的类在ERROR级别时候传递到root logger中-->
    <logger name="slf4j2" level="ERROR"/>
    <!--根logger控制-->
    <root level="INFO">
        <appender-ref ref="STDOUT"/>
        <appender-ref ref="DayFile"/>
        <appender-ref ref="LOG_STASH_BUSINESS"/>
    </root>
</configuration>

配置要点说明:

<!--应用名称-->
<springProperty scope="context" name="APP_NAME" source="spring.application.name" defaultValue="springBoot"/>

指定日志记录的服务名称,与springboot配置中的spring.application.name对应,默认springBoot

<!--LogStash访问host-->
<springProperty name="LOG_STASH_HOST" scope="context" source="logstash.host" defaultValue="localhost"/>

指定logstash服务地址,与springboot配置中的logstash.host对应,默认localhost

<!--业务日志输出到LogStash-->
<appender name="LOG_STASH_BUSINESS" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
    <destination>${LOG_STASH_HOST}:4560</destination>
    <encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
        <providers>
            <timestamp>
                <timeZone>Asia/Shanghai</timeZone>
            </timestamp>
            <!--自定义日志输出格式-->
            <pattern>
                <pattern>
                    {
                    "service": "${APP_NAME:-}",
                    "level": "%level",
                    "pid": "${PID:-}",
                    "thread": "%thread",
                    "class": "%logger",
                    "traceId": "%X{traceId:-}",
                    "message": "%message",
                    "stack_trace": "%exception"
                    }
                </pattern>
            </pattern>
        </providers>
    </encoder>
</appender>

定义日志输出规则, 语法简单介绍:

• ${}: 获取spring配置参数,如${APP_NAME:-}
• ${name:-}: 获取值,默认空
• %name: log默认输出关键字,如:%level 日志级别
• %X{}: 系统变量, 比如通过MDC设置的变量,%X{traceId:-}用于日志追踪使用

<appender-ref ref="LOG_STASH_BUSINESS"/>

指定日志输出到logstash,ref与上边的name对应

启动项目,开始正式的日志分析!!!(好激动~~~)

3. kibana使用

项目启动成功后,我们会看到生成的索引:

kibana查看

elasticsearch-head查看

开始创建索引规则

选择时间过滤

查看数据

选择查看数据的时间段

数据已经显示出来了,但是看着挺乱的,选择message过滤

数据清爽了许多

查看详细数据,可以点小三角 △

异常信息,多行显示

下一篇: 离线日志数据导入elk

---

主要参考:

• https://www.toutiao.com/i6841047312022635021/
• https://juejin.im/post/5eef217d51882565d74fb4eb(原创)

答疑解惑:

• logstash 多行合并
  • https://blog.csdn.net/weixin_34228662/article/details/91766056
  • https://www.cnblogs.com/lovelinux199075/p/9104389.html
  • http://doc.yonyoucloud.com/doc/logstash-best-practice-cn/codec/multiline.html
• grok 语法
  • https://www.jianshu.com/p/443f1ea7b640
  • http://doc.yonyoucloud.com/doc/logstash-best-practice-cn/filter/grok.html
• logback pattern语法
  • https://www.cnblogs.com/hiver/p/9887116.html
  • http://www.kailing.pub/article/index/arcid/214.html
  • https://blog.csdn.net/ffyyhh995511/article/details/103737514
  • https://www.cnblogs.com/yin-jingyu/archive/2011/09/02/2163448.html