基于docker-compose快速玩转graylog

1.总体架构。mongo用于储存元数据及配置信息，暂用资源少，类似ZK。ES储存日志等数据，graylog类似于kibanan/grafana，初体验感觉是有较多不足

2.docker-compose快速搭建，注意虚拟机内存给4G左右，否则启动相当慢。启动：docker-compose  -f docker-compose.yml up -d

version: '2'
services:
  # MongoDB: https://hub.docker.com/_/mongo/
  mongo:
    image: mongo:3
    container_name: mongo
    networks:
      - graylog
  # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/docker.html
  elasticsearch:
    image: elasticsearch:6.8.4
    container_name: elasticsearch
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - http.cors.allow-origin="*"
      - http.cors.enabled=true
  #  ports:
  #   - "9200:9200"   #走自定义网络，不必暴露端口
  #    - "9300:9300"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    networks:
      - graylog
  # Graylog: https://hub.docker.com/r/graylog/graylog/
  graylog:
    image: graylog/graylog:3.1
    container_name: graylog
    environment:
      # CHANGE ME (must be at least 16 characters)!
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      # Password: admin
      - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
      - GRAYLOG_HTTP_EXTERNAL_URI=http://192.168.154.128:9000/
    networks:
      - graylog
    depends_on:
      - mongo
      - elasticsearch
    ports:
      # Graylog web interface and REST API
      - 9000:9000
      # Syslog TCP
      - 1514:1514
      # Syslog UDP
      - 1514:1514/udp
      # GELF TCP
      - 12201:12201
      # GELF UDP
      - 12201:12201/udp

  kibana:
    image: kibana:6.8.4   
    container_name: kibana              
    volumes:                                              
      - ./plugins:/usr/share/kibana/plugins:rw            
    #  - ./kibana/kibana.yml:/usr/share/kibana/config/kibana.yml:rw #默认连接http://localhost:9200 或http://elasticsearch容器名:9200
    networks:
      - graylog

    ports:                                               
      - "5601:5601"

networks:
  graylog:
    driver: bridge

更多详细配置参考docker hup官方镜像说明

 

3.springboot logback集成graylog

 <dependency>
		<groupId>biz.paluch.logging</groupId>
		<artifactId>logstash-gelf</artifactId>
		<version>1.13.0</version>
	</dependency>

 <appender name="GELF" class="biz.paluch.logging.gelf.logback.GelfLogbackAppender">
        <!-- 改为自己的IP-->
        <host>udp:192.168.152.128</host>
        <port>12201</port>
        <version>1.1</version>
        <!-- 这里可以定义为服务名等-->
        <facility>blockchain-module</facility>
		<!-- 手动添加字段 -->
		<additionalFields>version=4.1.0,module=blockchain</additionalFields>
        <extractStackTrace>true</extractStackTrace>
        <filterStackTrace>true</filterStackTrace>
        <mdcProfiling>true</mdcProfiling>
        <timestampPattern>yyyy-MM-dd HH:mm:ss,SSS</timestampPattern>
        <maximumMessageSize>8192</maximumMessageSize>
        <!-- This are fields using MDC -->
        <mdcFields>mdcField1,mdcField2</mdcFields>
        <dynamicMdcFields>mdc.*,(mdc|MDC)fields</dynamicMdcFields>
        <includeFullMdc>true</includeFullMdc>
    </appender>
    
    <root level="INFO">
        <appender-ref ref="GELF" />
        <appender-ref ref="STDOUT"/>
    </root>

4.打开graylog webUI  http://192.168.154.128:9000

配置input

访问springboot项目接口 curl localhost:8181/common/uploadXXXXXXXXXX，查看效果如下，另也有一些类似kibana visualize的一些图表，也支持监控报警，dashboard等，参考https://www.cnblogs.com/mrhugui/p/11543695.html