[英]How to view log in kibana
I am new to ELK, I tried ELK Stack with springboot using net.logstash.logback.appender.LogstashTcpSocketAppender.我是 ELK 的新手,我使用 net.logstash.logback.appender.LogstashTcpSocketAppender 在 springboot 中尝试了 ELK Stack。 I sent json messages to logstack.
我将 json 消息发送到 logstack。 Below is my configuration -
以下是我的配置 -
logback-spring.xml logback-spring.xml
<configuration>
<include resource="org/springframework/boot/logging/logback/defaults.xml" />
<springProperty scope="context" name="springAppName" source="spring.application.name" />
<property name="LOG_FILE" value="./${springAppName}" />
<property name="CONSOLE_LOG_PATTERN"
value="%clr(%d{yyyy-MM-dd HH:mm:ss.SSS}){faint} %clr(${LOG_LEVEL_PATTERN:-%5p}) %clr(${PID:- }){magenta} %clr(---){faint} %clr([%15.15t]){faint} %clr(%-40.40logger{39}){cyan} %clr(:){faint} %m%n${LOG_EXCEPTION_CONVERSION_WORD:-%wEx}" />
<appender name="logstash2"
class="net.logstash.logback.appender.LogstashTcpSocketAppender">
<destination>localhost:5000</destination>
<encoder
class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
`
<providers>
<timestamp>
<timeZone>UTC</timeZone>
</timestamp>
<pattern>
<pattern>
{
"severity": "%level",
"service": "${springAppName:-}",
"trace": "%X{X-B3-TraceId:-}",
"span": "%X{X-B3-SpanId:-}",
"parent": "%X{X-B3-ParentSpanId:-}",
"exportable":
"%X{X-Span-Export:-}",
"pid": "${PID:-}",
"thread": "%thread",
"class": "%logger{40}",
"rest": "%message"
}
</pattern>
</pattern>
</providers>
</encoder>
<keepAliveDuration>5 minutes</keepAliveDuration>
</appender>
<root level="INFO">
<appender-ref ref="logstash" />
</root>
</configuration>
config.json配置文件
input{
tcp{
port=> 5000
host=> localhost
}
}
filter {
# pattern matching logback pattern
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span},%{DATA:exportable}\]\s+%{DATA:pid}\s+---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:rest}" }
}
}
output {
elasticsearch { hosts => ["localhost:9200"] }
}
But when I open kibana to see the messages, I see whole log as message.但是当我打开 kibana 查看消息时,我将整个日志视为消息。 like below-
像下面 -
Can some one help me achieving the output as below -有人可以帮助我实现如下输出 -
Your filter block should look like that:您的过滤器块应如下所示:
filter {
# pattern matching logback pattern
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span},%{DATA:exportable}\]\s+%{DATA:pid}\s+---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:rest}" }
}
json{
source => "message"
}
}
I don't understand why you are not using index naming in output block?我不明白你为什么不在输出块中使用索引命名? You will encounter problems if you will have more than one index.
如果您有多个索引,您将遇到问题。 Add something like that:
添加类似的东西:
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "YOUR_INDEX_NAME-%{+YYYY.MM.dd}"
}
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.