一键搭建elk

news2025/1/19 2:17:52

一键启动elk

1. 生成环境的脚本

setup.sh

#!/usr/bin/bash

# logstash enviroment
mkdir -p logstash
touch logstash/logstash.conf
# shellcheck disable=SC1078
echo '
input {
      tcp {
          mode => "server"
          host => "0.0.0.0"
          port => 4560
          codec => json
        }
}
output {
      elasticsearch {
          hosts => "es:9200"
          index => "logstash-%{+YYYY.MM.dd}"
      }
}
' > logstash/logstash.conf

# elasticsearch enviroment
mkdir -p elasticsearch/plugins
mkdir -p elasticsearch/data

touch docker-compose.yml
echo "
version: '3.7'
services:
        elasticsearch:
          image: elasticsearch:7.6.2
          container_name: elasticsearch
          privileged: true
          user: root
          environment:
            #设置集群名称为elasticsearch
            - cluster.name=elasticsearch
            #以单一节点模式启动
            - discovery.type=single-node
            #设置使用jvm内存大小
            - ES_JAVA_OPTS=-Xms512m -Xmx512m
          volumes:
            - $PWD/elasticsearch/plugins:/usr/share/elasticsearch/plugins
            - $PWD/elasticsearch/data:/usr/share/elasticsearch/data
          ports:
            - 9200:9200
            - 9300:9300

        logstash:
          image: logstash:7.6.2
          container_name: logstash
          ports:
             - 4560:4560
          privileged: true
          environment:
            - TZ=Asia/Shanghai
          volumes:
            #挂载logstash的配置文件
            - $PWD/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
          depends_on:
            - elasticsearch
          links:
            #可以用es这个域名访问elasticsearch服务
            - elasticsearch:es


        kibana:
          image: kibana:7.6.2
          container_name: kibana
          ports:
              - 5601:5601
          privileged: true
          links:
            #可以用es这个域名访问elasticsearch服务
            - elasticsearch:es
          depends_on:
            - elasticsearch
          environment:
            #设置访问elasticsearch的地址
            - elasticsearch.hosts=http://es:9200
"> docker-compose.yml

chmod 777 elasticsearch/data

生成的文件
在这里插入图片描述

2. 启动容器

docker-compose up

3. SpringBoot配置Logstash客户端

pom.xml添加logstash依赖

        <!--集成logstash-->
        <dependency>
            <groupId>net.logstash.logback</groupId>
            <artifactId>logstash-logback-encoder</artifactId>
            <version>6.6</version>
        </dependency>

logback-spring.xml。

注意配置logstash日志收集的ip：port

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE configuration>
<configuration>
    <include resource="org/springframework/boot/logging/logback/defaults.xml"/>
    <include resource="org/springframework/boot/logging/logback/console-appender.xml"/>
    <!--应用名称-->
    <property name="APP_NAME" value="springsecurity-jwt"/>
    <!--日志文件保存路径-->
    <property name="LOG_FILE_PATH" value="${LOG_FILE:-${LOG_PATH:-${LOG_TEMP:-${java.io.tmpdir:-/tmp}}}/logs}"/>
    <contextName>${APP_NAME}</contextName>
    <!--每天记录日志到文件appender-->
    <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>${LOG_FILE_PATH}/${APP_NAME}-%d{yyyy-MM-dd}.log</fileNamePattern>
            <maxHistory>30</maxHistory>
        </rollingPolicy>
        <encoder>
            <pattern>${FILE_LOG_PATTERN}</pattern>
        </encoder>
    </appender>
    <!--输出到logstash的appender-->
    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <!--可以访问的logstash日志收集端口-->
        <destination>localhost:4560</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder"/>
    </appender>
    <root level="INFO">
        <appender-ref ref="CONSOLE"/>
        <appender-ref ref="FILE"/>
        <appender-ref ref="LOGSTASH"/>
    </root>
</configuration>

测试类AppTest

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.junit.jupiter.api.Test;
import org.springframework.boot.test.context.SpringBootTest;

@SpringBootTest
public class AppTest {

    //创建日志对象
    Logger logger = LogManager.getLogger(this.getClass());

    @Test
    public void test1() {
        logger.info("logback的日志信息过来了");
        logger.error("logback的错误信息过来了");
    }
}