springboot-fek's Introduction

springboot-fek

示例项目源码见 https://github.com/walkwolf/springboot-fek

目标

单点安装filebeat -> elasticsearch -> kibana 解析spring boot 日志

FEK方式，日志收集使用filebeat收集springboot日志文件信息，发送至es。

环境

服务器列表

192.168.1.100 filebeat client
192.168.1.11 kibana elasticsearch server

软件环境

jdk 1.8
centos 7.6
elk 7.3 (current yum latest)

双机准备

两台机器加入ELK yum仓库

rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch

vi /etc/yum.repos.d/elastic.repo


[elastic-7.x]
name=Elastic repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

es and kibana安装

192.168.1.11 执行


yum -y install elasticsearch
yum -y install kibana

systemctl enable elasticsearch
systemctl enable kibana

9200 非localhost可访问

vi /etc/elasticsearch/elasticsearch.yml 

network.host: 0.0.0.0
discovery.seed_hosts: ["0.0.0.0"]

非localhost IP可访问kibana

vi /etc/kibana/kibana.yml
server.host: "192.168.1.11"
elasticsearch.hosts: ["http://localhost:9200"]

启动

yum restart elasticsearch
yum restart kibana

filebeat 安装

192.168.1.100 执行

yum -y install filebeat
systemctl enable filebeat

修改filebeat生成默认索引名称

vi /etc/filebeat/filebeat.yml 

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["192.168.1.11:9200"]
setup.ilm.enabled: auto
setup.ilm.rollover_alias: "springapp1"
setup.ilm.pattern: "{now/d}-000001"

上传springboot应用解析模块

上传 springboot 目录至 /usr/share/filebeat/module 目录
上传 springboot.yml.disabled 文件至 /etc/filebeat/modules.d 目录

目录及文件在项目 filebeat 目录下

修改新增模块应用名称及收集日志来源

根据自己springboot 应用日志位置不同修改文件内容，默认是/root/log.txt

vi /usr/share/filebeat/module/springboot/debug/manifest.yml

    os.linux: 
      - /root/log.txt

启用新日志收集模块

filebeat modules enable springboot
systemctl restart filebeat

应用部署

略

测试源码可通过 giteee 下载

git clone https://github.com/walkwolf/springboot-fek.git
cd spring-boot-fek
mvn clean package
java -jar springboot-fek.jar

验证

springboot 日志 /root/log.txt 有内容
浏览器http://192.168.1.100:8080/normal 可看到返回normal，并生成日志
浏览器http://192.168.1.100:8080/fail 可/root/log.txt 看到异常堆栈信息
chrome head 插件访问 192.168.1.11:9200 可看到es索引情况，可见索引springapp1-yyyy.MM.dd-000001，索引。docs 数字不为0
http://192.168.1.11:5601/ kibana discover 新建springapp1-*，可按到springboot日志内容，并可正确解析 level、TID、THREADNAME、message输出
kibana 查看多行处理正常

调试提示

重新开始收集日志

chrome es head 插件删除索引springapp1-yyyy.MM.dd-000001
停止filebeat systemctl stop filebeat
删除现有filebeat 进度rm -rf /var/lib/filebeat
删除filebeat module 在es缓存 curl XDELETE http://192.168.1.11:9200/_ingest/pipeline/filebeat-7.3.0-springboot-debug-default
修改调试位置
启动filebeat收集 systemctl start filebeat

关键日志

filebeat可以开启日志，或者直接从系统日志查看启动运行情况 tail -f /var/log/message

核心点

filebeat springboot module(/usr/share/filebeat/module/springboot/debug/default.json) 解析配置及logback日志格式匹配

附1：开放端口号

filebeat
kibana 5601
elasticsearch 9200
elasticsearch 9300 集群内TCP

附2：官方配置

https://www.elastic.co/guide/en/beats/filebeat/7.3/setup-repositories.html

springboot-fek's People

Contributors

Stargazers

Watchers

springboot-fek's Issues

你好，我运行这个项目后，无法格式化springboot日志，请帮忙分析下可能的原因

我使用的是7.2.0版本。filebeat使用的windows版

日志显示启用了springboot pipline

2019-08-15T11:43:42.291+0800    DEBUG   [elasticsearch] elasticsearch/client.go:719     ES Ping(url=http://sunny-centos:9200)
2019-08-15T11:43:42.295+0800    DEBUG   [elasticsearch] elasticsearch/client.go:742     Ping status code: 200
2019-08-15T11:43:42.296+0800    INFO    elasticsearch/client.go:743     Attempting to connect to Elasticsearch version 7.2.0
2019-08-15T11:43:42.296+0800    DEBUG   [elasticsearch] elasticsearch/client.go:761     GET http://sunny-centos:9200/_xpack?human=false  <nil>
2019-08-15T11:43:42.318+0800    DEBUG   [modules]       fileset/pipelines.go:67 Required processors: []
2019-08-15T11:43:42.319+0800    DEBUG   [elasticsearch] elasticsearch/client.go:761     GET http://sunny-centos:9200/_ingest/pipeline/filebeat-7.3.0-springboot-debug-default  <nil>
2019-08-15T11:43:42.321+0800    DEBUG   [modules]       fileset/pipelines.go:120        Pipeline filebeat-7.3.0-springboot-debug-default already loaded
2019-08-15T11:43:42.321+0800    INFO    input/input.go:114      Starting input of type: log; ID: 15676272572826176120
2019-08-15T11:43:42.321+0800    INFO    cfgfile/reload.go:226   Loading of config files completed.

这是filebeat的debug日志,显示message没有被拆分

2019-08-15T11:43:58.400+0800    INFO    pipeline/output.go:105  Connection to backoff(elasticsearch(http://sunny-centos:9200)) established
2019-08-15T11:43:58.447+0800    DEBUG   [elasticsearch] elasticsearch/client.go:347     PublishEvents: 1 events have been published to elasticsearch in 46.8759ms.
2019-08-15T11:43:58.447+0800    DEBUG   [publisher]     memqueue/ackloop.go:160 ackloop: receive ack [0: 0, 1]
2019-08-15T11:43:58.448+0800    DEBUG   [publisher]     memqueue/eventloop.go:535       broker ACK events: count=1, start-seq=1, end-seq=1

2019-08-15T11:43:58.448+0800    DEBUG   [publisher]     memqueue/ackloop.go:128 ackloop: return ack to broker loop:1
2019-08-15T11:43:58.448+0800    DEBUG   [acker] beater/acker.go:64      stateful ack    {"count": 1}
2019-08-15T11:43:58.449+0800    DEBUG   [publisher]     memqueue/ackloop.go:131 ackloop:  done send ack
2019-08-15T11:43:58.449+0800    DEBUG   [registrar]     registrar/registrar.go:356      Processing 1 events
2019-08-15T11:43:58.450+0800    DEBUG   [registrar]     registrar/registrar.go:326      Registrar state updates processed. Count: 1
2019-08-15T11:43:58.451+0800    DEBUG   [registrar]     registrar/registrar.go:411      Write registry file: E:\sunny-e\work\filebeat-7.3.0-windows-x86_64\data\registry\filebeat\data.json (2)
2019-08-15T11:43:58.456+0800    DEBUG   [registrar]     registrar/registrar.go:404      Registry file updated. 2 states written.
2019-08-15T11:43:59.315+0800    DEBUG   [processors]    processing/processors.go:183    Publish event: {
  "@timestamp": "2019-08-15T03:43:59.315Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "7.3.0",
    "pipeline": "filebeat-7.3.0-springboot-debug-default"
  },
  "ecs": {
    "version": "1.0.1"
  },
  "host": {
    "name": "sunny的计算机",
    "id": "fcec9464-b962-47c4-87ba-ff0ade61820a",
    "hostname": "sunny的计算机",
    "architecture": "x86_64",
    "os": {
      "build": "17134.885",
      "platform": "windows",
      "version": "10.0",
      "family": "windows",
      "name": "Windows 10 Home China",
      "kernel": "10.0.17134.885 (WinBuild.160101.0800)"
    }
  },
  "message": "2019-08-15 11:43:55.867  INFO 21284 --- [restartedMain] hello.Application                        : Starting Application on sunny的计算机 with PID 21284 (D:\\sunny\\workspace\\sunny\\springboot-fek\\target\\classes started by
sunny in D:\\sunny\\workspace\\sunny\\springboot-fek)",
  "log": {
    "offset": 2471,
    "file": {
      "path": "e:\\data\\applogs\\springboot-fek.log"
    }
  },
  "input": {
    "type": "log"
  },
  "event": {
    "module": "springboot",
    "dataset": "springboot.debug"
  },
  "service": {
    "type": "springboot"
  },
  "fileset": {
    "name": "debug"
  },
  "agent": {
    "id": "88ddb4e3-80ce-459c-8b02-c4ca7bc8183e",
    "version": "7.3.0",
    "type": "filebeat",
    "ephemeral_id": "dff6d672-5ef5-4911-bfcc-3aa6651df04e",
    "hostname": "sunny的计算机"
  }
}
2019-08-15T11:43:59.351+0800    DEBUG   [processors]    processing/processors.go:183    Publish event: {
  "@timestamp": "2019-08-15T03:43:59.315Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "7.3.0",
    "pipeline": "filebeat-7.3.0-springboot-debug-default"
  },
  "event": {
    "module": "springboot",
    "dataset": "springboot.debug"
  },
  "fileset": {
    "name": "debug"
  },
  "service": {
    "type": "springboot"
  },
  "input": {
    "type": "log"
  },
  "host": {
    "name": "sunny的计算机",
    "id": "fcec9464-b962-47c4-87ba-ff0ade61820a",
    "hostname": "sunny的计算机",
    "architecture": "x86_64",
    "os": {
      "build": "17134.885",
      "platform": "windows",
      "version": "10.0",
      "family": "windows",
      "name": "Windows 10 Home China",
      "kernel": "10.0.17134.885 (WinBuild.160101.0800)"
    }
  },
  "agent": {
    "version": "7.3.0",
    "type": "filebeat",
    "ephemeral_id": "dff6d672-5ef5-4911-bfcc-3aa6651df04e",
    "hostname": "sunny的计算机",
    "id": "88ddb4e3-80ce-459c-8b02-c4ca7bc8183e"
  },
  "log": {
    "offset": 2745,
    "file": {
      "path": "e:\\data\\applogs\\springboot-fek.log"
    }
  },
  "message": "2019-08-15 11:43:55.871  INFO 21284 --- [restartedMain] hello.Application                        : The following profiles are active: local",
  "ecs": {
    "version": "1.0.1"
  }
}

Recommend Projects