1、logstash 插件配置

logstash下config文件夾下添加 test.conf 文件內容：

input{
        tcp {
                mode => "server"
                host => "0.0.0.0"
                port => 4567
                codec => json_lines
        }
}
output{
        elasticsearch{
                hosts=>["127.0.0.1:9200"]
                index 
 
=> "user-%{+YYYY.MM.dd}"
                }
        stdout{codec => rubydebug}
}

啟動logstash: ./logstash -f ../config/test.conf 暴露出端口4567接受日誌

2、spring boot 配置一些文件發送日誌即可

1）maven 依賴：

<dependency>
            <groupId>net.logstash.logback</groupId>
            <artifactId>logstash-logback-encoder</artifactId>
            <version>5.1</version>
 </dependency>

2）resources下添加logback-spring.xml 只需把下面ip地址修改一下即可

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <include resource="org/springframework/boot/logging/logback/base.xml" />

    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>172.31.226.157:4567</destination> //logstash ip和暴露的端口，我目前理解就是通過這個地址把日誌發送過去 
        <encoder charset="UTF-8" class
 
="net.logstash.logback.encoder.LogstashEncoder" />
    </appender>

    <root level="INFO">
        <appender-ref ref="LOGSTASH" />
        <appender-ref ref="CONSOLE" />
    </root>
</configuration>

3）yml 配置

logging:
  config: classpath:logback-spring.xml

大功告成，這樣啟動logstash 再啟動springBoot ,springboot的日誌就能發送過去了，之後elasticsearch收集，kibana圖形界面展示出來不贅述了

spring boot 集成logstash 日誌