docker搭建elk日志收集系統

系統日志是開發和調試的重要參考依據,線上的日志查詢起來比較繁瑣,很耗時間,使用elk方便搞定日志!!!

1. docker 配置

使用docker快速搭建elk日志收集系統,免去繁瑣安裝,下面直接看配置:

docker-compose

version: '3'
services:
  elasticsearch:
    image: es-ik:6.6.2
    container_name: elasticsearch
    restart: always
    environment:
      - "cluster.name=elasticsearch"
      - "discovery.type=single-node"
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ports:
    - 9200:9200
    - 9300:9300
  kibana:
    image: docker.elastic.co/kibana/kibana:6.6.2
    container_name: kibana
    environment:
      - SERVER_NAME=kibana
      - ELASTICSEARCH_URL=http://elasticsearch:9200
      - XPACK_MONITORING_ENABLED=true
    ports:
      - 5601:5601
    depends_on:
      - elasticsearch
  logstash:
    image: logstash:6.6.2
    container_name: logstash
    volumes:
      - ~/docker/mydata/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
    depends_on:
      - elasticsearch
    links:
      - elasticsearch:es
    ports:
      - 4560:4560

---

說明!!! es-ik:6.6.2是自己創建的鏡像,步驟: 創建帶ik插件鏡像

3個容器分別是:

1. elasticsearch 建立索引
2. kibana 數據可視化
3. logstash 數據收集

這三個組件首字母,簡稱就是ELK,沒什么可說的. docker-compose配置不復雜,不是本篇博客的重點,略過...

logstash.conf

input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4560
    codec => json_lines
    type => "business"
  }
}
output {
  elasticsearch {
    hosts => ["es:9200"]
    action => "index"
    codec => json
    index => "%{type}-%{+YYYY.MM.dd}"
    template_name => "business"
  }
}

上面docker-compose配置中,logstash有一個掛載文件,用來配置logstash. 定義輸入輸出規則,采用json數據輸出.

啟動docker容器之前,先創建~/docker/mydata/logstash/logstash.conf文件,否則則啟動會有問題.

啟動容器

啟動命令:
docker-compose up -d

查看docker進程,格式化輸出:
docker ps --format "table {{.ID}}\t{{.Names}}\t{{.Ports}}"

Logstash安裝json_lines插件

1. 進入logstash容器
   docker exec -it logstash /bin/bash
2. 安裝插件
   docker exec -it logstash /bin/bash

安裝完成后,訪問: ip:5601 即可看到kibana界面

2. logback配置

使用springboot集成方式實現日志收集,沒有使用日志監聽

logstash依賴

<!--    集成logstash    -->
<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>5.3</version>
</dependency>

logback-spring.xml

通過logback-spring.xml指定日志輸出,在配置文件中添加日志輸出到logstash,完整配置:

<?xml version="1.0" encoding="UTF-8" ?>
<configuration>
    <!--應用名稱-->
    <springProperty scope="context" name="APP_NAME" source="spring.application.name" defaultValue="springBoot"/>
    <!--LogStash訪問host-->
    <springProperty name="LOG_STASH_HOST" scope="context" source="logstash.host" defaultValue="localhost"/>
    <!-- 控制台輸出日志 -->
    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%X{traceId}] [%level] [%c:%L] - %msg%n</pattern>
        </encoder>
    </appender>
    <!--每天生成一個日志文件，保存30天的日志文件。-->
    <appender name="DayFile" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <File>logs/log.log</File>
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>logs/log.%d{yyyy-MM-dd}.log</fileNamePattern>
            <maxHistory>30</maxHistory>
        </rollingPolicy>
        <encoder>
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%X{traceId}] [%level] [%thread] [%c:%L] - %msg%n</pattern>
        </encoder>
    </appender>

    <!--業務日志輸出到LogStash-->
    <appender name="LOG_STASH_BUSINESS" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>${LOG_STASH_HOST}:4560</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <providers>
                <timestamp>
                    <timeZone>Asia/Shanghai</timeZone>
                </timestamp>
                <!--自定義日志輸出格式-->
                <pattern>
                    <pattern>
                        {
                        "service": "${APP_NAME:-}",
                        "level": "%level",
                        "pid": "${PID:-}",
                        "thread": "%thread",
                        "class": "%logger",
                        "traceId": "%X{traceId:-}",
                        "message": "%message",
                        "stack_trace": "%exception"
                        }
                    </pattern>
                </pattern>
            </providers>
        </encoder>
    </appender>

    <!--指定logger name為包名或類全名 指定級別 additivity設置是否傳遞到root logger -->
    <logger name="slf4j" level="INFO" additivity="false">
        <appender-ref ref="STDOUT"/>
        <appender-ref ref="DayFile"/>
        <appender-ref ref="LOG_STASH_BUSINESS"/>
    </logger>
    <!--slf4j2包下的類在ERROR級別時候傳遞到root logger中-->
    <logger name="slf4j2" level="ERROR"/>
    <!--根logger控制-->
    <root level="INFO">
        <appender-ref ref="STDOUT"/>
        <appender-ref ref="DayFile"/>
        <appender-ref ref="LOG_STASH_BUSINESS"/>
    </root>
</configuration>

配置要點說明:

<!--應用名稱-->
<springProperty scope="context" name="APP_NAME" source="spring.application.name" defaultValue="springBoot"/>

指定日志記錄的服務名稱,與springboot配置中的spring.application.name對應,默認springBoot

<!--LogStash訪問host-->
<springProperty name="LOG_STASH_HOST" scope="context" source="logstash.host" defaultValue="localhost"/>

指定logstash服務地址,與springboot配置中的logstash.host對應,默認localhost

<!--業務日志輸出到LogStash-->
<appender name="LOG_STASH_BUSINESS" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
    <destination>${LOG_STASH_HOST}:4560</destination>
    <encoder charset="UTF-8" class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
        <providers>
            <timestamp>
                <timeZone>Asia/Shanghai</timeZone>
            </timestamp>
            <!--自定義日志輸出格式-->
            <pattern>
                <pattern>
                    {
                    "service": "${APP_NAME:-}",
                    "level": "%level",
                    "pid": "${PID:-}",
                    "thread": "%thread",
                    "class": "%logger",
                    "traceId": "%X{traceId:-}",
                    "message": "%message",
                    "stack_trace": "%exception"
                    }
                </pattern>
            </pattern>
        </providers>
    </encoder>
</appender>

定義日志輸出規則, 語法簡單介紹:

• ${}: 獲取spring配置參數,如${APP_NAME:-}
• ${name:-}: 獲取值,默認空
• %name: log默認輸出關鍵字,如:%level 日志級別
• %X{}: 系統變量, 比如通過MDC設置的變量,%X{traceId:-}用於日志追蹤使用

<appender-ref ref="LOG_STASH_BUSINESS"/>

指定日志輸出到logstash,ref與上邊的name對應

啟動項目,開始正式的日志分析!!!(好激動~~~)

3. kibana使用

項目啟動成功后,我們會看到生成的索引:

kibana查看

elasticsearch-head查看

開始創建索引規則

選擇時間過濾

查看數據

選擇查看數據的時間段

數據已經顯示出來了,但是看着挺亂的,選擇message過濾

數據清爽了許多

查看詳細數據,可以點小三角 △

異常信息,多行顯示

下一篇: 離線日志數據導入elk

---

主要參考:

• https://www.toutiao.com/i6841047312022635021/
• https://juejin.im/post/5eef217d51882565d74fb4eb(原創)

答疑解惑:

• logstash 多行合並
  • https://blog.csdn.net/weixin_34228662/article/details/91766056
  • https://www.cnblogs.com/lovelinux199075/p/9104389.html
  • http://doc.yonyoucloud.com/doc/logstash-best-practice-cn/codec/multiline.html
• grok 語法
  • https://www.jianshu.com/p/443f1ea7b640
  • http://doc.yonyoucloud.com/doc/logstash-best-practice-cn/filter/grok.html
• logback pattern語法
  • https://www.cnblogs.com/hiver/p/9887116.html
  • http://www.kailing.pub/article/index/arcid/214.html
  • https://blog.csdn.net/ffyyhh995511/article/details/103737514
  • https://www.cnblogs.com/yin-jingyu/archive/2011/09/02/2163448.html