1.原配置
logstash.conf
input {
tcp {
host => "localhost"
port => 9601
mode => "server"
tags => ["tags"]
codec => json_lines
}
}
output {
elasticsearch {
hosts => "127.0.0.1:9200"
index => "%{[appname]}-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug}
}
logback.xml配置
<appender name="LOGSTASH"
class="net.logstash.logback.appender.LogstashTcpSocketAppender">
<destination>localhost:9601</destination>
<!-- encoder必须配置,有多种可选 -->
<encoder charset="UTF-8"
class="net.logstash.logback.encoder.LogstashEncoder">
<!-- "appname":"yang_test" 的作用是指定创建索引的名字时用，并且在生成的文档中会多了这个字段 -->
<customFields>{"appname":"tillo_approvice_service"}</customFields>
</encoder>
</appender>
2.rabbitmq方式
input {
rabbitmq {
type =>"all"
durable => true
exchange => "ex_logstash"
exchange_type => "direct"
key => "logstash"
host => "localhost:5672"
user => "guest"
password => "guest"
queue => "faceJob-logstash"
auto_delete => false
}}
output {
elasticsearch {
hosts => "127.0.0.1:9200"
}
stdout { codec => rubydebug}
}
logback.xml配置
<appender name="AMQP" class="org.springframework.amqp.rabbit.logback.AmqpAppender">
<layout>
<pattern>
<![CDATA[%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{50}.%method %line - %msg%n ]]>
</pattern>
</layout>
<host>127.0.0.1</host>
<port>5672</port>
<username>guest</username>
<password>guest</password>
<routingKeyPattern>logstash</routingKeyPattern>
<declareExchange>false</declareExchange>
<exchangeType>direct</exchangeType>
<exchangeName>ex_logstash</exchangeName>
<generateId>true</generateId>
<charset>UTF-8</charset>
<durable>true</durable>
<deliveryMode>PERSISTENT</deliveryMode>
</appender>