1.原配置
logstash.conf
input {
tcp {
host => "localhost"
port => 9601
mode => "server"
tags => ["tags"]
codec => json_lines
}
}
output {
elasticsearch {
hosts => "127.0.0.1:9200"
index => "%{[appname]}-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug}
}
logback.xml配置
<appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender"> <destination>localhost:9601</destination> <!-- encoder必须配置,有多种可选 --> <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder"> <!-- "appname":"yang_test" 的作用是指定创建索引的名字时用,并且在生成的文档中会多了这个字段 --> <customFields>{"appname":"tillo_approvice_service"}</customFields> </encoder> </appender> 2.rabbitmq方式
input {
rabbitmq {
type =>"all"
durable => true
exchange => "ex_logstash"
exchange_type => "direct"
key => "logstash"
host => "localhost:5672"
user => "guest"
password => "guest"
queue => "faceJob-logstash"
auto_delete => false
}}
output {
elasticsearch {
hosts => "127.0.0.1:9200"
}
stdout { codec => rubydebug}
}
logback.xml配置
<appender name="AMQP" class="org.springframework.amqp.rabbit.logback.AmqpAppender"> <layout> <pattern> <![CDATA[%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{50}.%method %line - %msg%n ]]> </pattern> </layout> <host>127.0.0.1</host> <port>5672</port> <username>guest</username> <password>guest</password> <routingKeyPattern>logstash</routingKeyPattern> <declareExchange>false</declareExchange> <exchangeType>direct</exchangeType> <exchangeName>ex_logstash</exchangeName> <generateId>true</generateId> <charset>UTF-8</charset> <durable>true</durable> <deliveryMode>PERSISTENT</deliveryMode> </appender>