logback LogstashEncoder elk

<?xml version="1.0" encoding="UTF-8"?>
<configuration scan="true">
    <!--定义日志文件的存储地址 勿在 LogBack 的配置中使用相对路径
    <property name="LOG_NAME" value="/home"></property>-->
    
    <appender name="LOGSTASH" class="ch.qos.logback.core.ConsoleAppender"> 
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder">
            <providers>
                <timestamp>
                    <timeZone>UTC</timeZone>
                </timestamp>
                <pattern>
                      <!-- exception 10行异常栈信息转存储到es 
                           traceId 链路调用标识
                           span 调用层级关系   
                       -->
                    <pattern>
                        {
                        "ip": "${ip}",
                        "app": "${appName}",
                        "level": "%level",
                        "trace": "%X{X-B3-TraceId:-}",
                        "span": "%X{X-B3-SpanId:-}",
                        "parent": "%X{X-B3-ParentSpanId:-}",
                        "thread": "%thread",
                        "class": "%logger{40}",
                        "message": "%message",
                        "stack_trace": "%exception{10}"
                        　　　　　　　　　　　　　}
                    </pattern>
                </pattern>
            </providers>
        </encoder>
    </appender>

    <springProfile name="prod">
        <root level="info">
            <appender-ref ref="LOGSTASH"/>
        </root>
    </springProfile>

    <springProfile name="dev">
        <root level="info">
            <appender-ref ref="LOGSTASH"/>
        </root>
    </springProfile>
</configuration>

 

logstash 配置

input {
   tcp {
     port => 5044
     codec => json_lines
   }


}
filter {
    multiline {
        #pattern => "^%{TIMESTAMP_ISO8601}"
        pattern => "^\s"
      what => "previous"
        }
urldecode{
 field =>message
 }
}
output {
  elasticsearch {
    hosts => ["es:9200"]
  }

}

docker logstash 配置

  logstash:
    image: logstash:6.5.4
    container_name: logstash
    volumes:
      - ./es/logstash/pipeline:/usr/share/logstash/pipeline
      - ./es/logstash/config:/usr/share/logstash/config
    environment:
      - ELASTICSEARCH_URL="http://es:9200"
    networks:
      - javanet
    ports:
      - 5044:5044
      - 9600:9600

参考

https://blog.youkuaiyun.com/qq_33430322/article/details/89238944