Logstash集成log4j

utydgf

1. 配置log4j.properties

1 2 3 4 5 6

log4j.rootLogger=INFO,DEBUG,logstash log4j.appender.logstash=org.apache.log4j.net.SocketAppender log4j.appender.logstash.Port=4560 log4j.appender.logstash.RemoteHost=10.0.0.5 log4j.appender.logstash.ReconnetionDelay=60000 log4j.appender.logstash.LocationInfo=true

2. 修改logstash input组件(favblog-log4j.conf)，将日志输出到Elasticsearch

1 2 3 4 5 6 7 8 9 10 11 12

input{ log4j{     host => "10.0.0.5"     mode => "server"     type => "log4j-json"     port => 4560 } } output{     stdout{ codec => rubydebug }     elasticsearch { hosts => ["10.0.0.5:9200"] } }

3.启动Logstash

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52

[iyunv@Server bin]# ./logstash -f favblog-log4j.conf Settings: Default pipeline workers: 4 log4j:WARN No appenders could be found for logger (org.apache.http.client.protocol.RequestAuthCache). log4j:WARN Please initialize the log4j system properly. log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info. Pipeline main started {         "message" => "*************************************Hello test!",        "@version" => "1",      "@timestamp" => "2016-05-31T07:24:34.989Z",       "timestamp" => 1464679190253,            "path" => "com.favccxx.favblog.platform.interceptor.FavInterceptor",        "priority" => "INFO",     "logger_name" => "com.favccxx.favblog.platform.interceptor.FavInterceptor",          "thread" => "http-bio-8080-exec-2",           "class" => "com.favccxx.favblog.platform.interceptor.FavInterceptor",            "file" => "AppAuthorityInterceptor.java:65",          "method" => "intercept",            "host" => "10.0.0.115:54930",            "type" => "log4j-json" } {         "message" => "** errorInvokeKey:[MBGL-S]QemI2gBhHC",        "@version" => "1",      "@timestamp" => "2016-05-31T07:24:35.000Z",       "timestamp" => 1464679190264,            "path" => "com.favccxx.favblog.platform.interceptor.FavInterceptor",        "priority" => "ERROR",     "logger_name" => "com.favccxx.favblog.platform.interceptor.FavInterceptor",          "thread" => "http-bio-8080-exec-2",           "class" => "com.favccxx.favblog.platform.interceptor.FavInterceptor",            "file" => "AppAuthorityInterceptor.java:140",          "method" => "intercept",            "host" => "10.0.0.115:54930",            "type" => "log4j-json" } {         "message" => "Exception occurred during processing request: Cannot create a session after the response has been committed",        "@version" => "1",      "@timestamp" => "2016-05-31T07:24:35.023Z",       "timestamp" => 1464679190280,            "path" => "org.apache.struts2.dispatcher.DefaultDispatcherErrorHandler",        "priority" => "ERROR",     "logger_name" => "org.apache.struts2.dispatcher.DefaultDispatcherErrorHandler",          "thread" => "http-bio-8080-exec-2",           "class" => "com.opensymphony.xwork2.util.logging.commons.CommonsLogger",            "file" => "CommonsLogger.java:42",          "method" => "error",     "stack_trace" => "java.lang.IllegalStateException: Cannot create a session after the response has been committed\n\tat org.apache.catalina.connector.Request.doGetSession(Request.java:3013)\n\tat org.apache.catalina.connector.Request.getSession(Request.java:2385)\n\tat org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:897)\n\tat javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:229)\n\tat org.apache.struts2.dispatcher.SessionMap.put(SessionMap.java:182)\n\tat org.apache.struts2.interceptor.MessageStoreInterceptor.after(MessageStoreInterceptor.java:297)\n\tat org.apache.struts2.interceptor.MessageStoreInterceptor.intercept(MessageStoreInterceptor.java:198)\n\tat com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:244)\n\tat org.apache.struts2.impl.StrutsActionProxy.execute(StrutsActionProxy.java:54)\n\tat org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:564)\n\tat org.apache.struts2.dispatcher.ng.ExecuteOperations.executeAction(ExecuteOperations.java:81)\n\tat org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter.doFilter(StrutsPrepareAndExecuteFilter.java:99)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)\n\tat org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)\n\tat org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)\n\tat org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)\n\tat org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)\n\tat org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)\n\tat org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)\n\tat org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)\n\tat org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:423)\n\tat org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1079)\n\tat org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:625)\n\tat org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)\n\tat org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tat java.lang.Thread.run(Unknown Source)",            "host" => "10.0.0.115:54930",            "type" => "log4j-json" }

4. 查询Log4j输出日志

1	http://10.0.0.5:9200/logstash-2016.05.31/_search?q=*&pretty%27

在elasticsearch中查询到输出的log4j日志。