<aside> 💡 这里使用docker部署

</aside>

拉取镜像

docker pull logstash:6.5.0

配置logstash

1. 创建映射目录

   mkdir /Users/huajiejun/projects/logstash/config
   mkdir /Users/huajiejun/projects/logstash/pipeline
   

2. config下创建配置文件 logstash.yml和piplelines.yml

   • logstash.yml

   config:
     reload:
    ****   automatic: true
       interval: 3s
   xpack:
     management.enabled: false
     monitoring.enabled: false
   

   

   • pipeline.yml

   - pipeline.id: logstash_dev
     path.config: "/usr/share/logstash/pipeline/logstash_dev.conf"
   
   

3. pipeline下创建配置logstash_dev.conf

   • logstash_dev.conf

   input {
     tcp {
       mode => "server"
       host => "0.0.0.0"
       port => 5047
       codec => json_lines
     }
   }
   filter{
   }
   output {
       elasticsearch { 
         hosts => ["192.168.150.130:9200"] 
         index => "logstash-dev-%{+YYYY.MM.dd}"
       }
       stdout { codec => rubydebug }
   }
   

   

启动容器

docker run -d -it   --privileged=true  --name=logstash -p 5047:5047 -p 9600:9600 -v /home/software/logstash/pipeline:/usr/share/logstash/pipeline -v /home/software/logstash/config:/usr/share/logstash/config logstash:6.5.0

代码配置

pom.xml

<!-- logstash -->
  <dependency>
      <groupId>net.logstash.logback</groupId>
      <artifactId>logstash-logback-encoder</artifactId>
  </dependency>

logback.xml

<appender name="LOG_STASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>127.0.0.1:5047</destination>
        <queueSize>1048576</queueSize>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder" />
    </appender>

<!--指定最基础的日志输出级别-->
<root level="INFO">
    <!--appender将会添加到这个loger-->
    <appender-ref ref="fileLog"/>
    <appender-ref ref="STDOUT"/>
    <appender-ref ref="LOG_STASH"/>
</root>