一、创建一个springboot的项目

pom文件如下：

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
		 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<parent>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-parent</artifactId>
		<version>2.7.13</version>
		<relativePath/> <!-- lookup parent from repository -->
	</parent>
	<groupId>com.tuling</groupId>
	<artifactId>elk-demo</artifactId>
	<version>0.0.1-SNAPSHOT</version>
	<name>elk-demo</name>
	<description>elk-demo</description>
	<properties>
		<java.version>1.8</java.version>
	</properties>
	<dependencies>

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-web</artifactId>
		</dependency>

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-test</artifactId>
			<scope>test</scope>
		</dependency>
		<dependency>
			<groupId>net.logstash.logback</groupId>
			<artifactId>logstash-logback-encoder</artifactId>
			<version>5.3</version>
		</dependency>
		<dependency>
			<groupId>org.projectlombok</groupId>
			<artifactId>lombok</artifactId>
			<optional>true</optional>
		</dependency>

	</dependencies>

	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
			</plugin>
		</plugins>
	</build>

</project>

创建一个最简单的控制层，输出日志

修改application.properties默认配置，给这个项目起个名字

创建logback-spring.xml文件，修改destination这个改成自己的服务器地址，端口是logstash同步es的端口，可以看第一节课

<?xml version="1.0" encoding="UTF-8"?>
<configuration debug="false">
    <!--提取配置文件中的服务名-->
    <springProperty scope="context" name="springApplicationName" source="spring.application.name" />
    <property name="LOG_HOME" value="logs/demo.log" />
    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{50} - %msg%n</pattern>
        </encoder>
    </appender>

    <appender name="logstash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
            <level>INFO</level>
        </filter>
        <destination>192.168.85.200:4560</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
        <providers>
            <timestamp>
                <timeZone>Asia/Shanghai</timeZone>
            </timestamp>
            <!--自定义日志输出格式-->
            <pattern>
                <pattern>
                    {
                    "project": "elk",
                    "level": "%level",
                    "service": "${springApplicationName:-}",
                    "pid": "${PID:-}",
                    "thread": "%thread",
                    "class": "%logger",
                    "message": "%message",
                    "stack_trace": "%exception"
                    }
                </pattern>
            </pattern>
        </providers>
        </encoder>
    </appender>

    <root level="INFO">
        <appender-ref ref="STDOUT" />
        <appender-ref ref="logstash" />
    </root>
</configuration>

二、创建索引模式

匹配上之后点击下一步

3、测试

如图，就有了日志

测试我们写的接口是否有日志，代码在最上面


以上，就完成了最简单的elk日志搭建，但是还会有更复杂的情况，比如日志如何删除？
多个springboot如何搭建？
如果springboot部署在容器上配置是否一致？

结语：技术的道路艰难又不艰难，贵在坚持!