基于mq搭建elk

官网地址:https://www.elastic.co/guide/en/logstash/current/plugins-inputs-rabbitmq.html

Logstash是一个开源数据收集引擎，具有实时管道功能。Logstash可以动态地将来自不同数据源的数据统一起来，并将数据标准化到你所选择的目的地

安装

在官网下载之后解压
logstash-sample.conf

这里主要配置日志的输入和输出,下面是通过mq输入,输出到es的例子,放在bin文件夹下

input { 
   rabbitmq {
       exchange => "notificationExchage"
	   exchange_type => "topic"
	   key => "xwxlogstash"
	   host => "172.16.20.1"
	   port => 5672
	   user => "test"
	   password => "itsme999"
	   queue => "xwxlogstash"
       auto_delete => false
	   vhost => "/dev"
    
  }	
 }

output {
  elasticsearch { 
       hosts => ["localhost:9200"] 
	   index => "xwxlogstash_log_mq"
	   }
}

在bin下面执行cmd ---logstash -f logstash-sample.conf

遇到的问题:

解压之后的文件夹路径不能带中文,不然会报错

logback-spring配置
上述logstash启动之后,进行logback-spring配置

 <appender name="RabbitMq" class="org.springframework.amqp.rabbit.logback.AmqpAppender">
        <host>172.16.20.1</host>
        <port>5672</port>
        <username>test</username>
        <password>itsme999</password>
        <virtualHost>/dev</virtualHost>
        <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
            <level>INFO</level>
        </filter>
        <routingKeyPattern>xwxlogstash</routingKeyPattern>
        <declareExchange>true</declareExchange>
        <exchangeType>topic</exchangeType>
        <exchangeName>notificationExchage</exchangeName>
        <generateId>true</generateId>
        <durable>false</durable>
        <declareExchange>true</declareExchange>
        <autoDelete>false</autoDelete>
        <charset>UTF-8</charset>
        <layout class="ch.qos.logback.classic.PatternLayout">
            <pattern>
                <![CDATA[%msg]]>
            </pattern>
        </layout>
    </appender>