ELK记录日志（windows）

安装（Windows）

下载地址：https://www.elastic.co/cn/downloads/

PS：要配置 jdk 环境变量。

ElasticSearch（分布式搜索引擎）

• 配置：config/elasticsearch.yml

network.host: 127.0.0.1
http.port: 9200
# 跨域
http.cors.enabled: true
http.cors.allow-origin: "*"


• 启动：bin/elasticsearch.bat

LogStash（收集存储日志）

• 配置：config/logstash-sample.conf

input {
file {
type => "nginx_access"
path => "D:/software/ELK/logs/logstash.log"
}
}
output {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "access-%{+YYYY.MM.dd}"
}
stdout {
codec => json_lines
}
}


• 启动：.\logstash.bat -f …/config/logstash-sample.conf

Kibana（界面）

• 配置：config/kibana.yml

server.port: 5601
server.host: "127.0.0.1"
elasticsearch.hosts: ["http://127.0.0.1:9200"]


• 启动：bin/kibana.bat

• logback-spring.xml


<configuration>

<property name="log.path" value="D:/software/ELK/logs"/>

<property name="log.pattern" value="%d{HH:mm:ss.SSS} [%thread] %-5level %logger{20} - [%method,%line] - %msg%n"/>

<appender name="console" class="ch.qos.logback.core.ConsoleAppender">
<encoder>
<pattern>${log.pattern}pattern>
encoder>
appender>

<appender name="file_info" class="ch.qos.logback.core.rolling.RollingFileAppender">
<file>${log.path}/logstash.logfile>

<rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">

<fileNamePattern>${log.path}/sys-info.%d{yyyy-MM-dd}.logfileNamePattern>

<maxHistory>60maxHistory>
rollingPolicy>
<encoder>
<pattern>${log.pattern}pattern>
encoder>
<filter class="ch.qos.logback.classic.filter.LevelFilter">



<onMatch>ACCEPTonMatch>

<onMismatch>DENYonMismatch>
filter>
appender>
<appender name="file_error" class="ch.qos.logback.core.rolling.RollingFileAppender">
<file>${log.path}/sys-error.logfile>

<rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">

<fileNamePattern>${log.path}/sys-error.%d{yyyy-MM-dd}.logfileNamePattern>

<maxHistory>60maxHistory>
rollingPolicy>
<encoder>
<pattern>${log.pattern}pattern>
encoder>
<filter class="ch.qos.logback.classic.filter.LevelFilter">

<level>ERRORlevel>

<onMatch>ACCEPTonMatch>

<onMismatch>DENYonMismatch>
filter>
appender>

<appender name="sys-user" class="ch.qos.logback.core.rolling.RollingFileAppender">
<file>${log.path}/sys-user.logfile>
<rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">

<fileNamePattern>${log.path}/sys-user.%d{yyyy-MM-dd}.logfileNamePattern>

<maxHistory>60maxHistory>
rollingPolicy>
<encoder>
<pattern>${log.pattern}pattern>
encoder>
appender>

<logger name="com.example" level="debug"/>

<logger name="org.springframework" level="warn"/>
<root level="info">
<appender-ref ref="console"/>
root>

<root level="info">
<appender-ref ref="file_info"/>
<appender-ref ref="file_error"/>
root>

<logger name="sys-user" level="info">
<appender-ref ref="sys-user"/>
logger>
configuration>


• application.yml

logging:
config: classpath:logback-spring.xml
查看日志

Kibana 地址：http://localhost:5601/

• Add Filter：logstash-sample.conf → output → elasticsearch → index
• 查看日志列表