ELK配置文件（一台服务器，与logback结合）

原

1、elasticsearch.yml

network.host: 0.0.0.0
http.port: 9200
action.auto_create_index: .security,.monitoring*,.watches,.triggered_watches,.watcher-history*,logstash-test1
 

2、kibana.yml

server.port: 5601
server.host: "0.0.0.0"
elasticsearch.url: "http://127.0.0.1:9200"

3、logstash.conf

input {
  tcp {
    port => 9516
    host => "127.0.0.1"
    mode => "server"
    ssl_enable => false
    codec => "json"
  }
}

output {
  stdout {
    codec => rubydebug
    }
  elasticsearch {
    hosts => "127.0.0.1:9200"
    index => "logstash-test1"
  }
}

4、nginx

location ~(/app/timelion|/app/kibana|/bundles|/es_admin|/plugins|/api/console|/api/timelion|/ui/|/elasticsearch) {
    proxy_pass              http://localhost:5601;
    proxy_set_header        Host $host;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;
    proxy_set_header        X-Forwarded-Host $http_host;
}

5、logback

<appender name="你自己的其他日志名" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>logs/smsService.log</file><!--配置的路径-->
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <!-- rollover daily -->
            <fileNamePattern>logs/smsService.%d{yyyy-MM-dd}_%i.log.zip</fileNamePattern>
            <timeBasedFileNamingAndTriggeringPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedFNATP">
                <maxFileSize>30MB</maxFileSize>
            </timeBasedFileNamingAndTriggeringPolicy>
            <!-- keep 30 days' worth of history -->
            <maxHistory>10</maxHistory>
        </rollingPolicy>
        <encoder>
            <charset>UTF-8</charset>
            <pattern>%date{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
        </encoder>
</appender>

<!-- stash是往logstash里写日志  一点要配 -->

<appender name="stash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>10.25.69.195:9516</destination>
        <!-- 这个IP是你logstash所在IP，端口号是logstash的端口号-->
        <queueSize>1048576</queueSize>
        <!-- encoder is required -->
        <encoder class="net.logstash.logback.encoder.LogstashEncoder" />
</appender>

<!--生产环境:打印控制台和输出到文件-->
    <springProfile name="prod">
        <root level="info">
            <appender-ref ref="CONSOLE"/>
            <appender-ref ref="stash"/>
        </root>


        <logger name="你自己的其他日志名" level="debug" additivity="false">
            <!-- 连接输出源，也就是上边那几个输出源 ，你可以随便选几个appender-->
            <appender-ref ref="smsAppender"/>
            <appender-ref ref="stash"/>
        </logger>


    </springProfile>

6、后台启动

kibana                             nohup bin/kibana &

elasticsearch                   ./elasticsearch -d 

logstash

7、正常启动

kibana                             bin/kibana

elasticsearch                    bin/elasticsearch                   

logstash                           bin/logstash -f config/logstash_conf.conf

https://juejin.im/entry/59a52f56f265da248236350f

/etc/opt