springboot+ELK日誌監控系統

ELK簡介
ELK是Elasticsearch+Logstash+Kibana簡稱

Elasticsearch 是一個分佈式的搜索和分析引擎，能夠用於全文檢索、結構化檢索和分析，並能將這三者結合起來。Elasticsearch 基於 Lucene 開發，如今是使用最廣的開源搜索引擎之一。

Logstash 簡單來講就是一根具有實時數據傳輸能力的管道，負責將數據信息從管道的輸入端傳輸到管道的輸出端，與此同時這根管道還可讓你根據本身的需求在中間加上濾網，Logstash提供了不少功能強大的濾網以知足你的各類應用場景。

Kibana 是一個開源的分析與可視化平臺，設計出來用於和Elasticsearch一塊兒使用的。你能夠用kibana搜索、查看、交互存放在Elasticsearch索引裏的數據，使用各類不一樣的圖標、表格、地圖等，kibana可以很輕易的展現高級數據分析與可視化。

---

ELK下載安裝
能夠去官網分別下載安裝：https://www.elastic.co/downlo...
須要提早安裝JDK1.8，這裏我是在windows上操做。

---

Elasticsearch安裝啓動
如圖，下載Elasticsearch並解壓

config/elasticsearch.yml配置文件，修改配置（也是默認配置，能夠不作修改）

network.host=localhost
network.port=9200

sticsearch.bat，啓動成功，訪問localhost:9200

{
  "name" : "cTP-_7z",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "6tnImaw3RyKHlErGQrtuvw",
  "version" : {
    "number" : "6.3.1",
    "build_flavor" : "default",
    "build_type" : "zip",
    "build_hash" : "eb782d0",
    "build_date" : "2018-06-29T21:59:26.107521Z",
    "build_snapshot" : false,
    "lucene_version" : "7.3.1",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}

---

logstash安裝啓動
如圖，下載Logstash並解壓

bin目錄下新建配置log4j_to_es.conf

input {
    tcp {  
    ##host:port就是上面appender中的 destination，這裏其實把logstash做爲服務，開啓8080端口接收logback發出的消息  
        host => "localhost"  
        port => 8080  
    #模式選擇爲server  
        mode => "server"  
        tags => ["tags"]  

    ##格式json  
        codec => json_lines         
    }  

} 

output {
        elasticsearch {
        #ES地址
                hosts => "127.0.0.1:9200"
        #指定索引名字
                index => "applog"
        }
        stdout { codec => rubydebug}
}

新建文件run_default.bat

logstash -f log4j_to_es.conf

保存直接雙擊該配置文件，啓動成功，控制檯輸出以下：

訪問localhost:9600：

{"host":"LAPTOP-MJ88A0EI","version":"6.3.1","http_address":"127.0.0.1:9600","id":"a0fe5a6f-e35d-4c5f-8b87-24344a928239","name":"LAPTOP-MJ88A0EI","build_date":"2018-06-29T22:43:59Z","build_sha":"b79493047db01afca1e11c856fe8538d7ecb5787","build_snapshot":false}

---

Kibana安裝啓動
如圖，下載Kibana並解壓

這裏，直接默認配置便可，bin/kibana.bat雙擊運行，啓動成功，訪問localhost:5601

至此，軟件啓動完畢！

---

建立SpringBoot項目，pom.xml文件以下：

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.zm.elk</groupId>
    <artifactId>elk</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>jar</packaging>

    <name>elk</name>
    <description></description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.3.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-log4j</artifactId>
            <version>1.3.8.RELEASE</version>
        </dependency>

        <dependency>
            <groupId>net.logstash.logback</groupId>
            <artifactId>logstash-logback-encoder</artifactId>
            <version>4.9</version>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>


</project>

log4j的配置以下：

log4j.rootLogger=INFO,console

# for package com.demo.elk, log would be sent to socket appender.
log4j.logger.com.forezp=DEBUG, socket

# appender socket
log4j.appender.socket=org.apache.log4j.net.SocketAppender
log4j.appender.socket.Port=4560
log4j.appender.socket.RemoteHost=localhost
log4j.appender.socket.layout=org.apache.log4j.PatternLayout
log4j.appender.socket.layout.ConversionPattern=%d [%-5p] [%l] %m%n
log4j.appender.socket.ReconnectionDelay=10000

# appender console
log4j.appender.console=org.apache.log4j.ConsoleAppender
log4j.appender.console.target=System.out
log4j.appender.console.layout=org.apache.log4j.PatternLayout
log4j.appender.console.layout.ConversionPattern=%d [%-5p] [%l] %m%n

logback..xml配置以下：

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
    <destination>localhost:8080</destination>
    <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder" />
</appender>
<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
    <encoder charset="UTF-8"> <!-- encoder 能夠指定字符集，對於中文輸出有意義 -->
        <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger - %msg%n</pattern>
    </encoder>
</appender>

<root level="INFO">
    <appender-ref ref="LOGSTASH" />
    <appender-ref ref="STDOUT" />
</root>

</configuration>

目錄結構以下：

log測試：

import org.junit.Before;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.test.context.junit4.SpringRunner;

@RunWith(SpringRunner.class)
@SpringBootTest
public class ElkApplicationTests {

    // 定義一個全局的記錄器，經過LoggerFactory獲取
    private final static Logger log = LoggerFactory.getLogger(Test.class);

    @Before
    public void setUp() {
    }
    @Test
    public void test() {
        log.trace("trace 成功了");
        log.debug("debug 成功了");
        log.info("info 成功了");
        log.warn("warn 成功了");
        log.error("error 成功了");
    }

}

回到kibana上查看信息：

而後create index pattern

回到Discover

在右邊就能看到具體的日誌信息啦！！

還能夠本身修改filter查看須要的信息，具體的本身能夠搗鼓搗鼓玩玩。