logstash启动配置文件

input {

tcp {

port => 14560

codec => json_lines

}

}

filter{

#将message JSON 对象解析

json{

source => "message"

}

}

output{

#推送到elasticsearch接收配置

elasticsearch {

hosts => ["127.0.0.1:9200"]

index =>"%{[appname]}-%{+YYYY.MM.dd}"

}

#控制台输出

stdout { codec => rubydebug }

}

#Logstash接收配置

input

#tcp接收

tcp {

port 接收端口

codec 结果格式

}

#文件接收

file{

path 文件地址

}

logback配置

<!-- 输出到logstash -->
    <appender name="logstash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>192.168.1.1:4560</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder" >
            <customFields>{"appname":"gds-search-log"}</customFields>
        </encoder>
          <!-- 此日志文件只记录info级别的 -->
        <filter class="ch.qos.logback.classic.filter.LevelFilter">
            <level>INFO</level>
            <onMatch>ACCEPT</onMatch>
            <onMismatch>DENY</onMismatch>
        </filter>
    </appender>

<logger name="gds_hk_stat_count" level="INFO" additivity="false">
        <appender-ref ref="gds_hk_stat_count"/>
    </logger>

项目logstash集成

<dependency>
            <groupId>net.logstash.logback</groupId>
            <artifactId>logstash-logback-encoder</artifactId>
            <version>4.7</version>
        </dependency>