logstash安裝log4j插件

本文主要參考：https://www.cnblogs.com/chinway/p/9841759.html

目前的環境如下：

logstash-6.2.4

elasticsearch-6.2.4

kibana-6.2.4-linux-x86_64

centos 5.5

在安裝好ELK的情況下

對logstash操作

/usr/local/app/logstash-6.2.4/config

 vi log4j_es.conf

input {
    log4j {
        host => "127.0.0.1"
        port => 4560
    }
}

output {
    stdout {
      codec => rubydebug
    }
    elasticsearch{
        hosts => ["localhost:9200"]
        index => "log4j-%{+YYYY.MM.dd}"
        document_type => "log4j_type"
    }
}

 啟動Logstash

./bin/logstash -f config/log4j-es.conf

當出現錯誤時

input加入log4j插件啟動報如下錯誤

[2019-11-07T16:25:57,709][ERROR][logstash.plugins.registry] Tried to load a plugin's code, but failed. {:exception=>#<LoadError: no such file to load -- logstash/inputs/log4j>, :path=>"logstash/inputs/log4j", :type=>"input", :name=>"log4j"}
說明還沒安裝插件logj4

 

去到bin目錄下面執行./logstash-plugin list

發現插件列表還真沒有logstash-input-log4j插件

安裝插件

./logstash-plugin install logstash-input-log4j

安裝會比較慢,需等待

 

 

 在項目中log4j.properties(放在resources文件夾下)

### 設置###
log4j.rootLogger = debug,stdout,D,E,logstash

### 輸出信息到控制抬 ###
log4j.appender.stdout = org.apache.log4j.ConsoleAppender
log4j.appender.stdout.Target = System.out
log4j.appender.stdout.layout = org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern = [%-5p] %d{yyyy-MM-dd HH:mm:ss,SSS} method:%l%n%m%n

### 輸出DEBUG 級別以上的日志到=/Users/bee/Documents/elk/log4j/debug.log###
log4j.appender.D = org.apache.log4j.DailyRollingFileAppender
log4j.appender.D.File = /Users/KG/Documents/logs/elk/debug.log
log4j.appender.D.Append = true
log4j.appender.D.Threshold = DEBUG
log4j.appender.D.layout = org.apache.log4j.PatternLayout
log4j.appender.D.layout.ConversionPattern = %-d{yyyy-MM-dd HH:mm:ss}  [ %t:%r ] - [ %p ]  %m%n

### 輸出ERROR 級別以上的日志到=/Users/bee/Documents/elk/log4j/error.log  ###
log4j.appender.E = org.apache.log4j.DailyRollingFileAppender
log4j.appender.E.File =/Users/KG/Documents/logs/elk/error.log
log4j.appender.E.Append = true
log4j.appender.E.Threshold = ERROR
log4j.appender.E.layout = org.apache.log4j.PatternLayout
log4j.appender.E.layout.ConversionPattern = %-d{yyyy-MM-dd HH:mm:ss}  [ %t:%r ] - [ %p ]  %m%n

#輸出日志到logstash
log4j.appender.logstash=org.apache.log4j.net.SocketAppender
log4j.appender.logstash.RemoteHost=127.0.0.1
log4j.appender.logstash.port=4560
log4j.appender.logstash.ReconnectionDelay=60000
log4j.appender.logstash.LocationInfo=true