一   内网搭建

1.docker-compose 部署 es kibana  logstash 

2.vim docker-compose （因为内网不能拉镜像 需要先用docker拉取镜像  有需要的私信我）

version: '3'
services:
  elasticsearch:
    image: elasticsearch:7.6.2
    container_name: elasticsearch
    user: root
    environment:
      - "cluster.name=elasticsearch" # 设置集群名称为elasticsearch
      - "discovery.type=single-node" # 以单一节点模式启动
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m" # 设置使用JVM内存大小
    volumes:
      - /data/elasticsearch/plugins:/usr/share/elasticsearch/plugins # 插件文件挂载
      - /data/elasticsearch/:/usr/share/elasticsearch/data # 数据文件挂载
    ports:
      - 9200:9200
      - 9300:9300
    networks:
      - shared-network

  logstash:
    image: logstash:7.6.2
    container_name: logstash
    environment:
      - TZ=Asia/Shanghai
    volumes:
      - /data/logstash/logstash-springboot.conf:/usr/share/logstash/pipeline/logstash.conf # 挂载Logstash的配置文件
    depends_on:
      - elasticsearch # Logstash在Elasticsearch启动之后再启动
    links:
      - elasticsearch:es # 可以用es这个域名访问Elasticsearch服务
    ports:
      - 4560:4560
    networks:
      - shared-network

  kibana:
    image: kibana:7.6.2
    container_name: kibana
    links:
      - elasticsearch:es # 可以用es这个域名访问Elasticsearch服务
    depends_on:
      - elasticsearch # Kibana在Elasticsearch启动之后再启动
    environment:
      - "elasticsearch.hosts=http://elasticsearch:9200" # 设置访问Elasticsearch的地址
    ports:
      - 5601:5601
    networks:
      - shared-network

networks:
  shared-network:
    external: true

3.微服务集成依赖 

<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>7.1.1</version>
</dependency>

4.logback.xml 编写

<?xml version="1.0" encoding="UTF-8"?>
<configuration scan="true" scanPeriod="60 seconds" debug="false">
    <!-- 日志存放路径 -->
    <property name="log.path" value="logs/smart-auth" />
    <!-- 日志输出格式 -->
    <property name="log.pattern" value="%d{HH:mm:ss.SSS} [%thread] %-5level %logger{20} - [%method,%line] - %msg%n" />

    <springProperty scope="context" name="name" source="spring.application.name"/>

    <!-- 输出到logstash的appender -->
    <appender name="logstash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <!-- 可以访问的logstash日志收集端口 -->
        <destination>192.168.1.43:4560</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder">
            <customFields>{"spring.application.name":"${name}"}</customFields>
        </encoder>
    </appender>

    <!-- 控制台输出 -->
    <appender name="console" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>${log.pattern}</pattern>
        </encoder>
    </appender>

    <!-- 系统日志输出 -->
    <appender name="file_info" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>${log.path}/info.log</file>
        <!-- 循环政策：基于时间创建日志文件 -->
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <!-- 日志文件名格式 -->
            <fileNamePattern>${log.path}/info.%d{yyyy-MM-dd}.log</fileNamePattern>
            <!-- 日志最大的历史 60天 -->
            <maxHistory>60</maxHistory>
        </rollingPolicy>
        <encoder>
            <pattern>${log.pattern}</pattern>
        </encoder>
        <filter class="ch.qos.logback.classic.filter.LevelFilter">
            <!-- 过滤的级别 -->
            <level>INFO</level>
            <!-- 匹配时的操作：接收（记录） -->
            <onMatch>ACCEPT</onMatch>
            <!-- 不匹配时的操作：拒绝（不记录） -->
            <onMismatch>DENY</onMismatch>
        </filter>
    </appender>

    <appender name="file_error" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>${log.path}/error.log</file>
        <!-- 循环政策：基于时间创建日志文件 -->
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <!-- 日志文件名格式 -->
            <fileNamePattern>${log.path}/error.%d{yyyy-MM-dd}.log</fileNamePattern>
            <!-- 日志最大的历史 60天 -->
            <maxHistory>60</maxHistory>
        </rollingPolicy>
        <encoder>
            <pattern>${log.pattern}</pattern>
        </encoder>
        <filter class="ch.qos.logback.classic.filter.LevelFilter">
            <!-- 过滤的级别 -->
            <level>ERROR</level>
            <!-- 匹配时的操作：接收（记录） -->
            <onMatch>ACCEPT</onMatch>
            <!-- 不匹配时的操作：拒绝（不记录） -->
            <onMismatch>DENY</onMismatch>
        </filter>
    </appender>

    <!-- 系统模块日志级别控制 -->
    <logger name="com.smart" level="info" />
    <!-- Spring日志级别控制 -->
    <logger name="org.springframework" level="warn" />

    <root level="info">
        <appender-ref ref="console" />
        <appender-ref ref="file_info" />
        <appender-ref ref="file_error" />
        <appender-ref ref="logstash" />
    </root>
</configuration>

注意： 需要修改的地方

1）vim /data/logstash/logstash-springboot.conf

2）input {
  tcp {
    port => 4560
    codec => json_lines { charset => "UTF-8" }
  }
}

filter {
  if [message] {
    json {
      source => "message"
      target => "json_message"
    }
  }

 mutate {
    add_field => { "[@metadata][index]" => "%{[spring.application.name]}-log-%{+YYYY.MM.dd}" }
  }

  if ![json_message] {
    mutate {
      add_field => { "message" => "%{message}" }
    }
  }
"/data/logstash/logstash-springboot.conf" 35L, 550C                                                                            16,1         顶端
input {
  tcp {
    port => 4560
    codec => json_lines { charset => "UTF-8" }
  }
}

filter {
  if [message] {
    json {
      source => "message"
      target => "json_message"
    }
  }

 mutate {
    add_field => { "[@metadata][index]" => "%{[spring.application.name]}-log-%{+YYYY.MM.dd}" }
  }

  if ![json_message] {
    mutate {
      add_field => { "message" => "%{message}" }
    }
  }
}

output {
  elasticsearch {
    hosts => ["http://192.168.1.43:9200"]
    index => "%{[@metadata][index]}"
  }
  stdout {
    codec => rubydebug
  }
}