应用和logstash解耦

应用和logstash解耦

基本形式的ELK日志搭建可以参见 ELK日志收集

日志输出到logstash，这其中要耗费时间进行日志的格式化建立tcp链接，发送请求。严重的情况下影响应用的性能。
所以要做应用和logstash的解耦合。
有两种行之有效的办法：1 redis解耦 2 消息队列解耦
两种方式解耦的原理一样，将消息发送到redis队列或者消息队列，logstash从队列中获取日志，这样避免了直接和应用融合在一起。

Redis解耦

引入依赖

<dependency>
    <groupId>com.cwbase</groupId>
    <artifactId>logback-redis-appender</artifactId>
    <version>1.1.5</version>
</dependency>

配置logback日志

appender name="redis" class="com.cwbase.logback.RedisAppender">
    <source>test-application</source>
    <!--type 可定为项目类型-->
    <type>test</type>
    <!--redis ip-->
    <host>192.168.1.218</host>
    <!--redis存放的key-->
    <key>logstash-redis</key>
    <tags>test-2</tags>
    <mdc>true</mdc>
    <location>true</location>
    <callerStackIndex>0</callerStackIndex>
    <!--additionalField添加附加字段 用于head插件显示-->
    <additionalField>
      <key>MyKey</key>
      <value>MyValue</value>
    </additionalField>
    <additionalField>
      <key>MySecondKey</key>
      <value>MyOtherValue</value>
    </additionalField>
  </appender>

配置logstash

input {
    redis {
        host => 'localhost'  #ip
        data_type => 'list'
        port => "6379"
        key => 'logstash-redis' #自定义
        type => 'redis-input'   #自定义
    }
}
output {
    elasticsearch {
        host => "localhost"  #ip
        codec => "json"
        protocol => "http"  #版本1.0+ 必须指定协议http
    }
}

消息队列解耦

引入依赖

<dependency>
	<groupId>org.springframework.amqp</groupId>
	<artifactId>spring-rabbit</artifactId>
</dependency>

配置logback日志

<!--logback日志写入rabbitmq -->
<appender name="RabbitMq"
	class="org.springframework.amqp.rabbit.logback.AmqpAppender">
	<layout>
		<pattern><![CDATA[ %d %p %t [%c] - <%m>%n ]]></pattern>
	</layout>
	<!--rabbitmq地址 -->
	<addresses>localhost:5672</addresses>
	<abbreviation>36</abbreviation>
	<includeCallerData>true</includeCallerData>
	<applicationId>bootsis</applicationId>
	<username>springcloud</username>
	<password>123456</password>
	<!--路邮件 -->
	<!--{applicationId}  -->
	<!--%property{applicationId}.%c.%p 收集不到日志  -->
	<!--最后改为精确匹配了  非常重要 -->
	<routingKeyPattern>bootsis</routingKeyPattern>
	<generateId>true</generateId>
	<charset>UTF-8</charset>
	<durable>true</durable>
	<deliveryMode>NON_PERSISTENT</deliveryMode>
	<declareExchange>true</declareExchange>
	<autoDelete>false</autoDelete>
</appender>

logstash配置

input { 
   rabbitmq {
       type =>"all"
       durable => true
       exchange => "logs"
	   exchange_type => "topic"
	   key => "bootsis"
	   host => "localhost"
	   port => 5672
	   user => "springcloud"
	   password => "123456"
	   queue => "boot-sis-mq"
       auto_delete => false
  }	
 }
output {
  elasticsearch { 
       hosts => ["localhost:9200"] 
	   index => "bootsis_log_mq"
	   }
}

导入数据库数据

有时间更新
https://www.cnblogs.com/eleven24/p/7733052.html
https://www.bbsmax.com/A/mo5k8nZQdw/