elk log use

elasticsearch +log4net.ElasticSearch+kibana（windows）

We need something (currently using version 5.6)

1. Install jdk and jre java environment configuration
2. Download elasticsearch, run elasticsearch-5.6.16 \ bin \ elasticsearch.bat start es, the default port 9200; (execution elasticsearch-service.bat install set to windows service)
3. Download kibana, run kibana-5.6.16-windows-x86 \ \ kibana.bat start bin kibana default port 5601; (execution nssm install kibana, set kibana path, set to windows service, you need to download NSSM)
4. regularly delete es index; delete index es \ deleteIndex \ delete.ext program attached to the windows task Scheduler, set to run once a day

var url=  ConfigurationManager.AppSettings["EsUrl"];
                var indexs = ConfigurationManager.AppSettings["EsIndex"];
                var day=int.Parse(ConfigurationManager.AppSettings["ESdeleteDay"]);
                log.Info($"url:{url}；索引：{indexs}；删除天数：{day}");
                var nodes = new Uri(url);
                var client = new ElasticClient(nodes);
                var index = indexs.Split(',');
                var time = DateTime.Now;
                foreach (var item in index)
                {
                    var logindex=item+"-"+time.AddDays(day * -1).ToString("yyyy.MM.dd");
                    var result = client.DeleteIndex(logindex);
                    IF (result.ApiCall.Success)
                    {
                        log.Info ($ "deleted Index: logindex {}"); 
                    } 
                }

Write logs to es

log4net.ElasticSearch based log4net, basic seamless docking log4net, only need to change the configuration to log4net.config

 <log4net>
    <root>
      <level value="All" />
      <!--记录到es-->
      <appender-ref ref="ElasticSearchAppender" />
    </root>
    <appender name="ElasticSearchAppender" type="log4net.ElasticSearch.ElasticSearchAppender, log4net.ElasticSearch">
      <layout type="log4net.Layout.PatternLayout,log4net">
        <param name="ConversionPattern" value="%d{ABSOLUTE} %-5p %c{1}:%L - %m%n" />
      </layout>

      <connectionString value="Server=localhost;Index=pxin_log;Port=9200;rolling=true"/>

      <lossy value="false" />
<!- corresponding to the buffer pool, it is written to over 10 ES -> 
      <Evaluator type = "log4net.Core.LevelEvaluator">
      <bufferSize value = "10" />

<! - abnormal level direct written es -> 
        <threshold value = "ERROR" />
      </ Evaluator> 
    </ appender> 
</ root> 
</ log4net>

Guess you like