你居然還去服務(wù)器上撈日志,搭個日志收集系統(tǒng)難道不香么!
ELK日志收集系統(tǒng)進階使用,本文主要講解如何打造一個線上環(huán)境真實可用的日志收集系統(tǒng)。有了它,你就可以和去服務(wù)器上撈日志說再見了!
ELK環(huán)境安裝
ELK是指Elasticsearch、Kibana、Logstash這三種服務(wù)搭建的日志收集系統(tǒng),具體搭建方式可以參考《SpringBoot應(yīng)用整合ELK實現(xiàn)日志收集》。這里僅提供最新版本的docker-compose腳本和一些安裝要點。
docker-compose腳本
version:?'3'
services:
??elasticsearch:
????image:?elasticsearch:6.4.0
????container_name:?elasticsearch
????environment:
??????-?"cluster.name=elasticsearch"?#設(shè)置集群名稱為elasticsearch
??????-?"discovery.type=single-node"?#以單一節(jié)點模式啟動
??????-?"ES_JAVA_OPTS=-Xms512m?-Xmx512m"?#設(shè)置使用jvm內(nèi)存大小
??????-?TZ=Asia/Shanghai
????volumes:
??????-?/mydata/elasticsearch/plugins:/usr/share/elasticsearch/plugins?#插件文件掛載
??????-?/mydata/elasticsearch/data:/usr/share/elasticsearch/data?#數(shù)據(jù)文件掛載
????ports:
??????-?9200:9200
??????-?9300:9300
??kibana:
????image:?kibana:6.4.0
????container_name:?kibana
????links:
??????-?elasticsearch:es?#可以用es這個域名訪問elasticsearch服務(wù)
????depends_on:
??????-?elasticsearch?#kibana在elasticsearch啟動之后再啟動
????environment:
??????-?"elasticsearch.hosts=http://es:9200"?#設(shè)置訪問elasticsearch的地址
??????-?TZ=Asia/Shanghai
????ports:
??????-?5601:5601
??logstash:
????image:?logstash:6.4.0
????container_name:?logstash
????environment:
??????-?TZ=Asia/Shanghai
????volumes:
??????-?/mydata/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf?#掛載logstash的配置文件
????depends_on:
??????-?elasticsearch?#kibana在elasticsearch啟動之后再啟動
????links:
??????-?elasticsearch:es?#可以用es這個域名訪問elasticsearch服務(wù)
????ports:
??????-?4560:4560
??????-?4561:4561
??????-?4562:4562
??????-?4563:4563
安裝要點
使用
docker-compose命令運行所有服務(wù):
docker-compose?up?-d
第一次啟動可能會發(fā)現(xiàn)Elasticsearch
無法啟動,那是因為/usr/share/elasticsearch/data目錄沒有訪問權(quán)限,只需要修改/mydata/elasticsearch/data目錄的權(quán)限,再重新啟動;
chmod?777?/mydata/elasticsearch/data/
Logstash需要安裝
json_lines插件。
logstash-plugin?install?logstash-codec-json_lines
分場景收集日志
這里為了方便我們查看日志,提出一個分場景收集日志的概念,把日志分為以下四種。
調(diào)試日志:最全日志,包含了應(yīng)用中所有
DEBUG級別以上的日志,僅在開發(fā)、測試環(huán)境中開啟收集;錯誤日志:只包含應(yīng)用中所有
ERROR級別的日志,所有環(huán)境只都開啟收集;業(yè)務(wù)日志:在我們應(yīng)用
對應(yīng)包下打印的日志,可用于查看我們自己在應(yīng)用中打印的業(yè)務(wù)日志;記錄日志:每個接口的
訪問記錄,可以用來查看接口執(zhí)行效率,獲取接口訪問參數(shù)。
Logback配置詳解
要實現(xiàn)上面的分場景收集日志,主要通過Logback的配置來實現(xiàn),我們先來了解下Logback的配置吧!
完全配置
在SpringBoot中,如果我們想要自定義Logback的配置,需要自行編寫
logback-spring.xml文件,下面是我們這次要使用的完全配置。
<configuration>
????
????<include?resource="org/springframework/boot/logging/logback/defaults.xml"/>
????
????<include?resource="org/springframework/boot/logging/logback/console-appender.xml"/>
????
????<springProperty?scope="context"?name="APP_NAME"?source="spring.application.name"?defaultValue="springBoot"/>
????
????<property?name="LOG_FILE_PATH"?value="${LOG_FILE:-${LOG_PATH:-${LOG_TEMP:-${java.io.tmpdir:-/tmp}}}/logs}"/>
????
????<springProperty?name="LOG_STASH_HOST"?scope="context"?source="logstash.host"?defaultValue="localhost"/>
????
????<appender?name="FILE_DEBUG"
??????????????class="ch.qos.logback.core.rolling.RollingFileAppender">
????????
????????<filter?class="ch.qos.logback.classic.filter.ThresholdFilter">
????????????<level>DEBUGlevel>
????????filter>
????????<encoder>
????????????
????????????<pattern>${FILE_LOG_PATTERN}pattern>
????????????<charset>UTF-8charset>
????????encoder>
????????<rollingPolicy?class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
????????????
????????????<fileNamePattern>${LOG_FILE_PATH}/debug/${APP_NAME}-%d{yyyy-MM-dd}-%i.logfileNamePattern>
????????????
????????????<maxFileSize>${LOG_FILE_MAX_SIZE:-10MB}maxFileSize>
????????????
????????????<maxHistory>${LOG_FILE_MAX_HISTORY:-30}maxHistory>
????????rollingPolicy>
????appender>
????
????<appender?name="FILE_ERROR"
??????????????class="ch.qos.logback.core.rolling.RollingFileAppender">
????????
????????<filter?class="ch.qos.logback.classic.filter.LevelFilter">
????????????<level>ERRORlevel>
????????????<onMatch>ACCEPTonMatch>
????????????<onMismatch>DENYonMismatch>
????????filter>
????????<encoder>
????????????
????????????<pattern>${FILE_LOG_PATTERN}pattern>
????????????<charset>UTF-8charset>
????????encoder>
????????<rollingPolicy?class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
????????????
????????????<fileNamePattern>${LOG_FILE_PATH}/error/${APP_NAME}-%d{yyyy-MM-dd}-%i.logfileNamePattern>
????????????
????????????<maxFileSize>${LOG_FILE_MAX_SIZE:-10MB}maxFileSize>
????????????
????????????<maxHistory>${LOG_FILE_MAX_HISTORY:-30}maxHistory>
????????rollingPolicy>
????appender>
????
????<appender?name="LOG_STASH_DEBUG"?class="net.logstash.logback.appender.LogstashTcpSocketAppender">
????????<filter?class="ch.qos.logback.classic.filter.ThresholdFilter">
????????????<level>DEBUGlevel>
????????filter>
????????<destination>${LOG_STASH_HOST}:4560destination>
????????<encoder?charset="UTF-8"?class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
????????????<providers>
????????????????<timestamp>
????????????????????<timeZone>Asia/ShanghaitimeZone>
????????????????timestamp>
????????????????
????????????????<pattern>
????????????????????<pattern>
????????????????????????{
????????????????????????"project":?"mall-tiny",
????????????????????????"level":?"%level",
????????????????????????"service":?"${APP_NAME:-}",
????????????????????????"pid":?"${PID:-}",
????????????????????????"thread":?"%thread",
????????????????????????"class":?"%logger",
????????????????????????"message":?"%message",
????????????????????????"stack_trace":?"%exception{20}"
????????????????????????}
????????????????????pattern>
????????????????pattern>
????????????providers>
????????encoder>
????????
????????<connectionStrategy>
????????????<roundRobin>
????????????????<connectionTTL>5?minutesconnectionTTL>
????????????roundRobin>
????????connectionStrategy>
????appender>
????
????<appender?name="LOG_STASH_ERROR"?class="net.logstash.logback.appender.LogstashTcpSocketAppender">
????????<filter?class="ch.qos.logback.classic.filter.LevelFilter">
????????????<level>ERRORlevel>
????????????<onMatch>ACCEPTonMatch>
????????????<onMismatch>DENYonMismatch>
????????filter>
????????<destination>${LOG_STASH_HOST}:4561destination>
????????<encoder?charset="UTF-8"?class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
????????????<providers>
????????????????<timestamp>
????????????????????<timeZone>Asia/ShanghaitimeZone>
????????????????timestamp>
????????????????
????????????????<pattern>
????????????????????<pattern>
????????????????????????{
????????????????????????"project":?"mall-tiny",
????????????????????????"level":?"%level",
????????????????????????"service":?"${APP_NAME:-}",
????????????????????????"pid":?"${PID:-}",
????????????????????????"thread":?"%thread",
????????????????????????"class":?"%logger",
????????????????????????"message":?"%message",
????????????????????????"stack_trace":?"%exception{20}"
????????????????????????}
????????????????????pattern>
????????????????pattern>
????????????providers>
????????encoder>
????????
????????<connectionStrategy>
????????????<roundRobin>
????????????????<connectionTTL>5?minutesconnectionTTL>
????????????roundRobin>
????????connectionStrategy>
????appender>
????
????<appender?name="LOG_STASH_BUSINESS"?class="net.logstash.logback.appender.LogstashTcpSocketAppender">
????????<destination>${LOG_STASH_HOST}:4562destination>
????????<encoder?charset="UTF-8"?class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
????????????<providers>
????????????????<timestamp>
????????????????????<timeZone>Asia/ShanghaitimeZone>
????????????????timestamp>
????????????????
????????????????<pattern>
????????????????????<pattern>
????????????????????????{
????????????????????????"project":?"mall-tiny",
????????????????????????"level":?"%level",
????????????????????????"service":?"${APP_NAME:-}",
????????????????????????"pid":?"${PID:-}",
????????????????????????"thread":?"%thread",
????????????????????????"class":?"%logger",
????????????????????????"message":?"%message",
????????????????????????"stack_trace":?"%exception{20}"
????????????????????????}
????????????????????pattern>
????????????????pattern>
????????????providers>
????????encoder>
????????
????????<connectionStrategy>
????????????<roundRobin>
????????????????<connectionTTL>5?minutesconnectionTTL>
????????????roundRobin>
????????connectionStrategy>
????appender>
????
????<appender?name="LOG_STASH_RECORD"?class="net.logstash.logback.appender.LogstashTcpSocketAppender">
????????<destination>${LOG_STASH_HOST}:4563destination>
????????<encoder?charset="UTF-8"?class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
????????????<providers>
????????????????<timestamp>
????????????????????<timeZone>Asia/ShanghaitimeZone>
????????????????timestamp>
????????????????
????????????????<pattern>
????????????????????<pattern>
????????????????????????{
????????????????????????"project":?"mall-tiny",
????????????????????????"level":?"%level",
????????????????????????"service":?"${APP_NAME:-}",
????????????????????????"class":?"%logger",
????????????????????????"message":?"%message"
????????????????????????}
????????????????????pattern>
????????????????pattern>
????????????providers>
????????encoder>
????????
????????<connectionStrategy>
????????????<roundRobin>
????????????????<connectionTTL>5?minutesconnectionTTL>
????????????roundRobin>
????????connectionStrategy>
????appender>
????
????<logger?name="org.slf4j"?level="INFO"/>
????<logger?name="springfox"?level="INFO"/>
????<logger?name="io.swagger"?level="INFO"/>
????<logger?name="org.springframework"?level="INFO"/>
????<logger?name="org.hibernate.validator"?level="INFO"/>
????<root?level="DEBUG">
????????<appender-ref?ref="CONSOLE"/>
????????
????????
????????<appender-ref?ref="LOG_STASH_DEBUG"/>
????????<appender-ref?ref="LOG_STASH_ERROR"/>
????root>
????<logger?name="com.macro.mall.tiny.component"?level="DEBUG">
????????<appender-ref?ref="LOG_STASH_RECORD"/>
????logger>
????<logger?name="com.macro.mall"?level="DEBUG">
????????<appender-ref?ref="LOG_STASH_BUSINESS"/>
????logger>
configuration>
配置要點解析
使用默認的日志配置
一般我們不需要自定義控制臺輸出,可以采用默認配置,具體配置參考
console-appender.xml,該文件在spring-boot-${version}.jar下面。
<include?resource="org/springframework/boot/logging/logback/defaults.xml"/>
<include?resource="org/springframework/boot/logging/logback/console-appender.xml"/>
springProperty
該標簽可以從SpringBoot的配置文件中獲取配置屬性,比如說在不同環(huán)境下我們的Logstash服務(wù)地址是不一樣的,我們就可以把該地址定義在
application.yml來使用。
例如在application-dev.yml中定義了這些屬性:
logstash:
??host:?localhost
在logback-spring.xml中就可以直接這樣使用:
<springProperty?scope="context"?name="APP_NAME"?source="spring.application.name"?defaultValue="springBoot"/>
<springProperty?name="LOG_STASH_HOST"?scope="context"?source="logstash.host"?defaultValue="localhost"/>
filter
在Logback中有兩種不同的過濾器,用來過濾日志輸出。
ThresholdFilter:臨界值過濾器,過濾掉低于指定臨界值的日志,比如下面的配置將過濾掉所有低于INFO級別的日志。
<filter?class="ch.qos.logback.classic.filter.ThresholdFilter">
????<level>INFOlevel>
filter>
LevelFilter:級別過濾器,根據(jù)日志級別進行過濾,比如下面的配置將過濾掉所有非ERROR級別的日志。
<filter?class="ch.qos.logback.classic.filter.LevelFilter">
????<level>ERRORlevel>
????<onMatch>ACCEPTonMatch>
????<onMismatch>DENYonMismatch>
filter>
appender
Appender可以用來控制日志的輸出形式,主要有下面三種。
ConsoleAppender:控制日志輸出到控制臺的形式,比如在
console-appender.xml中定義的默認控制臺輸出。
<appender?name="CONSOLE"?class="ch.qos.logback.core.ConsoleAppender">
?<encoder>
??<pattern>${CONSOLE_LOG_PATTERN}pattern>
?encoder>
appender>
RollingFileAppender:控制日志輸出到文件的形式,可以控制日志文件生成策略,比如文件名稱格式、超過多大重新生成文件以及刪除超過多少天的文件。
<appender?name="FILE_ERROR"
??????????class="ch.qos.logback.core.rolling.RollingFileAppender">
????<rollingPolicy?class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
????????
????????<fileNamePattern>${LOG_FILE_PATH}/error/${APP_NAME}-%d{yyyy-MM-dd}-%i.logfileNamePattern>
????????
????????<maxFileSize>${LOG_FILE_MAX_SIZE:-10MB}maxFileSize>
????????
????????<maxHistory>${LOG_FILE_MAX_HISTORY:-30}maxHistory>
????rollingPolicy>
appender>
LogstashTcpSocketAppender:控制日志輸出到Logstash的形式,可以用來配置Logstash的地址、訪問策略以及日志的格式。
<appender?name="LOG_STASH_ERROR"?class="net.logstash.logback.appender.LogstashTcpSocketAppender">
????<destination>${LOG_STASH_HOST}:4561destination>
????<encoder?charset="UTF-8"?class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
????????<providers>
????????????<timestamp>
????????????????<timeZone>Asia/ShanghaitimeZone>
????????????timestamp>
????????????
????????????<pattern>
????????????????<pattern>
????????????????????{
????????????????????"project":?"mall-tiny",
????????????????????"level":?"%level",
????????????????????"service":?"${APP_NAME:-}",
????????????????????"pid":?"${PID:-}",
????????????????????"thread":?"%thread",
????????????????????"class":?"%logger",
????????????????????"message":?"%message",
????????????????????"stack_trace":?"%exception{20}"
????????????????????}
????????????????pattern>
????????????pattern>
????????providers>
????encoder>
????
????<connectionStrategy>
????????<roundRobin>
????????????<connectionTTL>5?minutesconnectionTTL>
????????roundRobin>
????connectionStrategy>
appender>
logger
只有配置到logger節(jié)點上的appender才會被使用,logger用于配置哪種條件下的日志被打印,root是一種特殊的appender,下面介紹下日志劃分的條件。
調(diào)試日志:所有的DEBUG級別以上日志;
錯誤日志:所有的ERROR級別日志;
業(yè)務(wù)日志:
com.macro.mall包下的所有DEBUG級別以上日志;記錄日志:
com.macro.mall.tiny.component.WebLogAspect類下所有DEBUG級別以上日志,該類是統(tǒng)計接口訪問信息的AOP切面類。
控制框架輸出日志
還有一些使用框架內(nèi)部的日志,DEBUG級別的日志對我們并沒有啥用處,都可以設(shè)置為了INFO以上級別。
<logger?name="org.slf4j"?level="INFO"/>
<logger?name="springfox"?level="INFO"/>
<logger?name="io.swagger"?level="INFO"/>
<logger?name="org.springframework"?level="INFO"/>
<logger?name="org.hibernate.validator"?level="INFO"/>
Logstash配置詳解
接下來我們需要配置下Logstash,讓它可以分場景收集不同的日志,下面詳細介紹下使用到的配置。
完全配置
input {
tcp {
mode => "server"
host => "0.0.0.0"
port => 4560
codec => json_lines
type => "debug"
}
tcp {
mode => "server"
host => "0.0.0.0"
port => 4561
codec => json_lines
type => "error"
}
tcp {
mode => "server"
host => "0.0.0.0"
port => 4562
codec => json_lines
type => "business"
}
tcp {
mode => "server"
host => "0.0.0.0"
port => 4563
codec => json_lines
type => "record"
}
}
filter{
if [type] == "record" {
mutate {
remove_field => "port"
remove_field => "host"
remove_field => "@version"
}
json {
source => "message"
remove_field => ["message"]
}
}
}
output {
elasticsearch {
hosts => ["es:9200"]
action => "index"
codec => json
index => "mall-tiny-%{type}-%{+YYYY.MM.dd}"
template_name => "mall-tiny"
}
}
配置要點
input:使用不同端口收集不同類型的日志,從4560~4563開啟四個端口;
filter:對于記錄類型的日志,直接將JSON格式的message轉(zhuǎn)化到source中去,便于搜索查看;
output:按類型、時間自定義索引格式。
SpringBoot配置
在SpringBoot中的配置可以直接用來覆蓋Logback中的配置,比如
logging.level.root就可以覆蓋節(jié)點中的level配置。
開發(fā)環(huán)境配置:application-dev.yml
logstash:
??host:?localhost
logging:
??level:
????root:?debug
測試環(huán)境配置:application-test.yml
logstash:
??host:?192.168.3.101
logging:
??level:
????root:?debug
生產(chǎn)環(huán)境配置:application-prod.yml
logstash:
??host:?logstash-prod
logging:
??level:
????root:?info
Kibana進階使用
進過上面ELK環(huán)境的搭建和配置以后,我們的日志收集系統(tǒng)終于可以用起來了,下面介紹下在Kibana中的使用技巧!
首先啟動我們的測試Demo,然后通用調(diào)用接口(可以使用Swagger),產(chǎn)生一些日志信息;

調(diào)用完成后在
Management->Kibana->Index Patterns中可以創(chuàng)建Index Patterns,Kibana服務(wù)訪問地址:http://192.168.3.101:5601

創(chuàng)建完成后可以在
Discover中查看所有日志,調(diào)試日志只需直接查看mall-tiny-debug*模式的日志即可;

對于日志搜索,kibana有非常強大的提示功能,可以通過搜索欄右側(cè)的
Options按鈕打開;

記錄日志只需直接查看
mall-tiny-record*模式的日志即可,如果我們想要搜索uri為/brand/listAll的記錄日志,只需在搜索欄中輸入uri : "/brand/listAll";

錯誤日志,只需直接查看
mall-tiny-error*模式的日志即可;

業(yè)務(wù)日志,只需直接查看
mall-tiny-business*模式的日志即可,這里我們可以查看一些SQL日志的輸出;

如果日志太大了,可以通過
Elasticsearch->Index Management選擇刪除即可。

項目源碼地址
https://github.com/macrozheng/mall-learning/tree/master/mall-tiny-log
有道無術(shù),術(shù)可成;有術(shù)無道,止于術(shù)
歡迎大家關(guān)注Java之道公眾號
好文章,我在看??
