听从建议https://blog.codecentric.de/en/2014/10/log-management-spring-boot-applications-logstash-elastichsearch-kibana/我已经设置了logstash编码器+logstash转发器将所有内容推送到我的logstash守护进程并最终索引 ElasticSearch 中的所有内容。
这是我的配置:
日志存储.xml
<included>
<include resource="org/springframework/boot/logging/logback/base.xml"/>
<property name="FILE_LOGSTASH" value="${LOG_FILE:-${LOG_PATH:-${LOG_TEMP:-${java.io.tmpdir:-/tmp}}/}spring.log}.json"/>
<appender name="LOGSTASH"
class="ch.qos.logback.core.rolling.RollingFileAppender">
<encoder>
<pattern>${FILE_LOG_PATTERN}</pattern>
</encoder>
<file>${FILE_LOGSTASH}</file>
<rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
<fileNamePattern>${FILE_LOGSTASH}.%i</fileNamePattern>
</rollingPolicy>
<triggeringPolicy
class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
<MaxFileSize>10MB</MaxFileSize>
</triggeringPolicy>
<encoder class="net.logstash.logback.encoder.LogstashEncoder">
<includeCallerInfo>true</includeCallerInfo>
</encoder>
</appender>
<root level="INFO">
<appender-ref ref="LOGSTASH"/>
</root>
</included>
logstash-forwarder.conf
{
"network": {
"servers": [
"logstash:5043"
],
"ssl certificate": "/etc/pki/tls/certs/logstash-forwarder/logstash-forwarder.crt",
"ssl key": "/etc/pki/tls/private/logstash-forwarder/logstash-forwarder.key",
"ssl ca": "/etc/pki/tls/certs/logstash-forwarder/logstash-forwarder.crt",
"timeout": 15
},
"files": [
{
"paths": [
"${ENV_SERVICE_LOG}/*.log.json"
],
"fields": {
"type": "${ENV_SERVICE_NAME}"
}
}
]
}
logstash.conf
input {
lumberjack {
port => 5043
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder/logstash-forwarder.key"
}
}
output {
elasticsearch { host => "localhost" }
}
一切正常,日志保存在 ElasticSearch 中。
在这一点上,我希望能够指定 ElasticSearch 索引的其他字段,例如日志级别。在@message 内容中搜索是否存在错误或警告并没有多大用处。
我怎样才能做到这一点?我应该更改哪个配置以使级别显示为 ElasticSearch 中的索引字段?