springboot集成ELK实现日志收集

安装ELK

我选择的是docker镜像方式安装的。参考elk-docker.readthedocs.io/

拉取elk镜像

docker pull sebp/elk:7.10.0

运行镜像

docker run -e ES_JAVA_OPTS="-Xms256m -Xmx256"  -p 5601:5601 -p 5044:5044 -p 9200:9200 -p 9300:9300 -it --name elk 649ed8dfdcc1

启动过程中如果出现以下错误

[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

解决方案

cd vim /etc/security/limits.conf 
在最后面追加下面内容 
es hard nofile 65536
es soft nofile 65536

[2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决方案

切换到root用户
vi /etc/sysctl.conf 
添加
vm.max_map_count=655360
执行命令：
sysctl -p

重启elk

docker restart elk

集成到springboot项目

增加logstach依赖

<dependency>    
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>6.6</version>
</dependency>

配置logback

将logback-spring.xml放到springboot项目的rescource目录下

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <!-- 彩色日志 -->
    <!-- 彩色日志依赖的渲染类 -->
    <conversionRule conversionWord="clr" converterClass="org.springframework.boot.logging.logback.ColorConverter" />
    <conversionRule conversionWord="wex" converterClass="org.springframework.boot.logging.logback.WhitespaceThrowableProxyConverter" />
    <conversionRule conversionWord="wEx" converterClass="org.springframework.boot.logging.logback.ExtendedWhitespaceThrowableProxyConverter" />
    <!-- 彩色日志格式 -->
    <property name="CONSOLE_LOG_PATTERN" value="${CONSOLE_LOG_PATTERN:-%clr(%d{yyyy-MM-dd HH:mm:ss.SSS}){faint} %clr(${LOG_LEVEL_PATTERN:-%5p}) %clr(${PID:- }){magenta} %clr(---){faint} %clr([%15.15t]){faint} [%X{traceLogId}] %clr(%-40.40logger{39}){cyan} %clr(:){faint} %m%n${LOG_EXCEPTION_CONVERSION_WORD:-%wEx}}"/>
    <!-- 开发环境 -->
    <springProfile name="dev">
        <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
            <encoder charset="UTF-8"> <!-- encoder 可以指定字符集，对于中文输出有意义 -->
                <pattern>${CONSOLE_LOG_PATTERN}</pattern>
            </encoder>
        </appender>

        <root level="INFO">
            <appender-ref ref="STDOUT"/>
        </root>
    </springProfile>

    <!-- 测试环境 -->
    <springProfile name="test">
        <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
            <destination>192.168.56.101:5044</destination>
            <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder"/>
        </appender>

        <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
            <encoder charset="UTF-8">
                <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] [%X{traceLogId}] %-5level %logger{50} - %msg%n</pattern>
            </encoder>
        </appender>

        <appender name="ROLLING_FILE"  class="ch.qos.logback.core.rolling.RollingFileAppender">
            <File>./logs/${project.artifactId}/info.log</File>
            <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
                <!--日志文件输出的文件名-->
                <FileNamePattern>./logs/${project.artifactId}/info.%d{yyyy-MM-dd}.log</FileNamePattern>
                <!--日志文件保留天数-->
                <maxHistory>7</maxHistory>
                <totalSizeCap>1GB</totalSizeCap>
            </rollingPolicy>
            <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
                <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] [%X{traceLogId}] %-5level %logger{50} - %msg%n</pattern>
            </encoder>
        </appender>

        <root level="INFO">
            <appender-ref ref="LOGSTASH"/>
            <appender-ref ref="STDOUT"/>
            <appender-ref ref="ROLLING_FILE"/>
        </root>
    </springProfile>

    <!-- 生产环境 -->
    <springProfile name="prod">
        <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
            <destination>192.168.56.101:5044</destination>            <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder"/>
        </appender>

        <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
            <encoder charset="UTF-8">
                <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] [%X{traceLogId}] %-5level %logger{50} - %msg%n</pattern>
            </encoder>
        </appender>

        <appender name="ROLLING_FILE"  class="ch.qos.logback.core.rolling.RollingFileAppender">
            <File>./logs/${project.artifactId}/info.log</File>
            <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
                <!--日志文件输出的文件名-->
                <FileNamePattern>./logs/${project.artifactId}/info.%d{yyyy-MM-dd}.log</FileNamePattern>
                <!--日志文件保留天数-->
                <maxHistory>7</maxHistory>
                <totalSizeCap>1GB</totalSizeCap>
            </rollingPolicy>
            <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
                <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] [%X{traceLogId}] %-5level %logger{50} - %msg%n</pattern>
            </encoder>
        </appender>

        <root level="INFO">
            <appender-ref ref="LOGSTASH"/>
            <appender-ref ref="STDOUT"/>
            <appender-ref ref="ROLLING_FILE"/>
        </root>
    </springProfile>

</configuration>

启动springboot项目
浏览器输入http://192.168.56.101:5601/    观察日志输出情况