elk日志分析

安装elk

安装elk，都是5.6版本

安装kafka

配置logback

<appender name="KAFKA" class="com.github.danielwegener.logback.kafka.KafkaAppender">        <encoder class="com.github.danielwegener.logback.kafka.encoding.PatternLayoutKafkaMessageEncoder">            <layout class="net.logstash.logback.layout.LogstashLayout">                <customFields>{"appname":"appname"}</customFields>            </layout>        </encoder>        <topic>my_logs</topic>        <keyingStrategy class="com.github.danielwegener.logback.kafka.keying.RoundRobinKeyingStrategy"/>        <deliveryStrategy class="com.github.danielwegener.logback.kafka.delivery.AsynchronousDeliveryStrategy"/>        <producerConfig>bootstrap.servers=127.0.0.1:9092</producerConfig>        <producerConfig>acks=1</producerConfig>        <producerConfig>linger.ms=100</producerConfig>    </appender>    <root level="info">        <appender-ref ref="KAFKA"/>    </root>

logstash启动

进入logstash目录，执行bin/logstash -f config/logstash.conf

input {    kafka {            bootstrap_servers => "localhost:9092"            topics => ["my_logs"]            codec => "json"            }}filter {        #Only matched data are send to output.}output {        # stdout{}        elasticsearch {                hosts => ["localhost:9200"]                index => "elasticse7"manage_template => false                }}

kibana查看日志消息

配置mapping，可以直接在kibana的devtool中执行

PUT elasticse7{    "mappings" : {      "logs7" : {        "properties" : {          "@timestamp" : {            "type" : "date"          },          "@version" : {            "type" : "text",            "fields" : {              "keyword" : {                "type" : "keyword",                "ignore_above" : 256              }            }          },          "logger_name" : {            "type" : "text",            "index": true          },          "thread_name" : {            "type" : "text",            "index": true          },          "level" : {            "type" : "text",            "index": true          },          "appname" : {            "type" : "text",            "index": true          },          "message" : {            "type" : "text",            "index": true          }        }      }    }  }

配置index，然后再执行discover查看日志就可以了