1. docker安装Elasticsearch

docker pull elasticsearch:7.6.2
mkdir -p  /mydata/elasticsearch/plugins  /mydata/elasticsearch/data
chmod 777 /mydata/elasticsearch/data/
docker run -p 9200:9200 -p 9300:9300 --name elasticsearch \
-e "discovery.type=single-node" \
-e "cluster.name=elasticsearch" \
-v /mydata/elasticsearch/plugins:/usr/share/elasticsearch/plugins \
-v /mydata/elasticsearch/data:/usr/share/elasticsearch/data \
-d elasticsearch:7.6.2

2. docker安装Logstash

docker pull logstash:7.6.2
mkdir /mydata/logstash
cd /mydata/logstash
vim logstash.conf
#将下面的配置放置到logstash.conf文件中
input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4560
    codec => json_lines
    type => "debug"
  }
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4561
    codec => json_lines
    type => "error"
  }
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4562
    codec => json_lines
    type => "business"
  }
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4563
    codec => json_lines
    type => "record"
  }
}
filter{
  if [type] == "record" {
    mutate {
      remove_field => "port"
      remove_field => "host"
      remove_field => "@version"
    }
    json {
      source => "message"
      remove_field => ["message"]
    }
  }
}
output {
  elasticsearch {
    hosts => "es:9200"
    index => "logback-%{type}-%{+YYYY.MM.dd}"
  }
}
docker run --name logstash -p 4560:4560 -p 4561:4561 -p 4562:4562 -p 4563:4563 \
--link elasticsearch:es \
-v /mydata/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf \
-d logstash:7.6.2

3. docker安装Kibana

docker pull kibana:7.6.2
docker run --name kibana -p 5601:5601 \
--link elasticsearch:es \
-e "elasticsearch.hosts=http://es:9200" \
-d kibana:7.6.2

4. springboot集成logstash

pom.xml引入maven依赖：

    net.logstash.logback
    logstash-logback-encoder
    7.3

resources下创建logback-spring.xml文件，配置如下，ip改成自己部署的logstash服务ip：

    
    
    
    
    
    
    
    
        
            INFO
        
        
        
            ${CONSOLE_LOG_PATTERN}
            utf8
        
    
    
    
        ip:4561
        
        
            
                
                    UTC
                
                
                    
                        {
                        "severity": "%level",
                        "service": "${springAppName:-}",
                        "trace": "%X{X-B3-TraceId:-}",
                        "span": "%X{X-B3-SpanId:-}",
                        "exportable": "%X{X-Span-Export:-}",
                        "pid": "${PID:-}",
                        "thread": "%thread",
                        "class": "%logger{40}",
                        "rest": "%message"
                        }
                    
                
            
        
    
    
    
        
        
    

5. 查询记录的日志

启动项目，随便写一个controller，记录日志

@RestController
public class TestLogController {
    /**
     * 获取日志输出对象
     */
    private static final Logger log = LoggerFactory.getLogger(TestLogController.class);
    /**
     * 测试输出log的访问方法
     */
    @GetMapping("/testLog")
    public String testLog() {
        log.error("测试输出一个日志");
        return "success";
    }
}

查询方式一：通过kibana

访问地址:http://ip:5601/

最终可以查看到记录的日志信息

 查询方式二：通过接口访问

添加依赖-添加实体类-添加service类-添加controller类-访问接口

        
            org.springframework.boot
            spring-boot-starter-data-elasticsearch
        
        
            org.projectlombok
            lombok
        

@Data public class LogEntry {
    private String date;
    private String message;
    private String type;
    private String service;
    public LogEntry(String date, String message,String type,String service) {
        this.date = date;
        this.message = message;
        this.type = type;
        this.service = service;
    }
}

@Service
public class ElasticsearchService {
    private final RestHighLevelClient client;
    @Autowired
    public ElasticsearchService(RestHighLevelClient client) {
        this.client = client;
    }
    public List getAllLogs() {
        List logEntries = new ArrayList<>();
        try {
            // 构建搜索请求--索引+倒序排序+查询所有
            SearchRequest searchRequest = new SearchRequest("logback-error-*");
            SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
            searchSourceBuilder.query(QueryBuilders.matchAllQuery());
            searchSourceBuilder.sort("@timestamp", SortOrder.DESC);
            searchRequest.source(searchSourceBuilder);
            // 执行搜索请求
            SearchResponse searchResponse = client.search(searchRequest, RequestOptions.DEFAULT);
            // 处理搜索结果
            for (SearchHit hit : searchResponse.getHits().getHits()) {
                Map sourceAsMap = hit.getSourceAsMap();
                String date = (String) sourceAsMap.get("@timestamp");
                String type = (String) sourceAsMap.get("type");
                String rest = (String) sourceAsMap.get("rest");
                String service = (String) sourceAsMap.get("service");
                logEntries.add(new LogEntry(date, rest,type,service));
            }
        } catch (IOException e) {
            e.printStackTrace();
        }
        return logEntries;
    }
}

@RestController
@RequestMapping("/api")
public class ElasticsearchController {
    private final ElasticsearchService elasticsearchService;
    @Autowired
    public ElasticsearchController(ElasticsearchService elasticsearchService) {
        this.elasticsearchService = elasticsearchService;
    }
    @GetMapping("/search")
    public List searchAllData() {
        return elasticsearchService.getAllLogs();
    }
}

最终可以看到查询出的结果