logstash 寫入elasticsearch 多索引設置

logstash的配置

• 啓動命令

 logstash.bat  -f  **.conf 

• 配置文件

數據輸入
input{
     tcp{
      host  => "127.0.0.1"
      port  =>  9100
      codec => "json"
  }
}

數據過濾
filter{
   mutate{
         lowercase=>["springAppName"]    轉爲小寫   索引不能有大寫
    }
}

數據輸出
output{
   if [traceId]  判斷 traceId是否存在  這裏過濾沒有traceId 的數據
{
     elasticsearch{
          action => "index"
          hosts  => "127.0.0.1:9200"
          index  => "%{springApName}"   動態索引
      }
    stdout{codec=>rubydebug}   控制檯輸出
}
 
}

logback的輸入設置

• maven的配置

        <dependency>
            <groupId>net.logstash.logback</groupId>
            <artifactId>logstash-logback-encoder</artifactId>
            <version>5.2</version>
        </dependency>

• logback.xml的配置

 <springProperty scope="context" name="springAppName" source="spring.application.name"/>

<!--日誌寫到logstash 在寫到es中 -->
    <appender name="stash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>127.0.0.1:9100</destination>
        <includeCallerData>true</includeCallerData>
        <encoder class="net.logstash.logback.encoder.LogstashEncoder">
            <includeCallerData>true</includeCallerData>
            <providers>
                <timestamp>
                    <timeZone>UTC</timeZone>
                </timestamp>
                <pattern>
                    <pattern>
                        {
                        "severity": "%level",
                        "service": "${springAppName:-}",
                        "trace": "%X{X-B3-TraceId:-}",
                        "span": "%X{X-B3-SpanId:-}",
                        "parent": "%X{X-B3-ParentSpanId:-}",
                        "exportable": "%X{X-Span-Export:-}",
                        "pid": "${PID:-}",
                        "thread": "%thread",
                        "class": "%logger{40}",
                        "rest": "%message"
                        }
                    </pattern>
                </pattern>
            </providers>
        </encoder>
    </appender>-->

與springCloud的整合

• maven依賴

      <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-zipkin</artifactId>
        </dependency>

加入maven依賴之後 在引入logback的配置 就可以將微服務的日誌發送導es中 然後根據traceId 進行某個請求的鏈路追蹤

ps

   "service": "${springAppName:-}",   ------>>>>     lowercase=>["springAppName"]  ---------->>>  index  => "%{springApName}"  

• 這個springAppName 的設置需要注意一下