blocks|key|4010190|text|如果您需要一种简单的方法来将您的Java应用程序日志导入到Elasticsearch中，那么安装并运行filebeat来读取您的应用程序日志并将其导入到ES中。您可以使用filebeat摄取节点来解析您的日志，并将其存储到Elasticsearch中的单个字段中，以帮助实现可视化等。或者，您也可以安装logstash来进行解析，而不是安装filebeat摄取管道。以下是一些可供阅读的链接，帮助您入门：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4010191|https://www.elastic.co/guide/en/beats/filebeat/current/configuring-howto-filebeat.html|4010192|https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ingest-node.html|4010193|https://www.elastic.co/guide/en/logstash/current/configuration.html|4010194|entityMap|0|LINK|mutability|MUTABLE|url|1|2^0|1F|8|0|0|2E|0|0|0|2B|1|0|0|1V|2|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|X|8|@]|D|@$9|Y|A|Z|1|10]]|E|$]]|$1|H|3|I|5|6|7|11|8|@]|D|@$9|12|A|13|1|14]]|E|$]]|$1|J|3|K|5|6|7|15|8|@]|D|@$9|16|A|17|1|18]]|E|$]]|$1|L|3|-4|5|6|7|19|8|@]|D|@]|E|$]]]|M|$N|$5|O|P|Q|E|$R|G]]|S|$5|O|P|Q|E|$R|I]]|T|$5|O|P|Q|E|$R|K]]]]

If you asking for an easy way to ingest your Java app logs into Elasticsearch then install &amp; run <code>filebeat</code> to read your app logs and ingest them into ES. You can use filebeat ingest node to be able to parse your logs and store them into individual fields in Elasticsearch to help with visualizing etc. Alternatively, you can also install logstash to do parsing instead of filebeat ingest pipelines. Some links for reading to get you started: 

<a href="https://www.elastic.co/guide/en/beats/filebeat/current/configuring-howto-filebeat.html" rel="nofollow noreferrer">https://www.elastic.co/guide/en/beats/filebeat/current/configuring-howto-filebeat.html</a>

<a href="https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ingest-node.html" rel="nofollow noreferrer">https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ingest-node.html</a>

<a href="https://www.elastic.co/guide/en/logstash/current/configuration.html" rel="nofollow noreferrer">https://www.elastic.co/guide/en/logstash/current/configuration.html</a>

blocks|key|4007261|text|您可以使用Filebeat通过RollingFileAppenders写入您的应用程序级别日志。将以下内容添加到您的logback.xml中，以将应用程序日志写入目录：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4007262|++++<appender+name="FILE"+class="ch.qos.logback.core.rolling.RollingFileAppender">
++++++++<file>/etc/logging/sample.log</file>
++++++++<immediateFlush>false</immediateFlush>
++++++++<rollingPolicy+class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
++++++++++++<fileNamePattern>
++++++++++++++++/etc/logging/hsvt_akka.%25d{yyyy-MM-dd}.%25i.log.zip
++++++++++++</fileNamePattern>
++++++++++++<maxFileSize>5KB</maxFileSize>
++++++++++++<maxHistory>20</maxHistory>
++++++++++++<totalSizeCap>1MB</totalSizeCap>
++++++++</rollingPolicy>
++++++++<encoder>
++++++++++++<pattern>[%25date{ISO8601}]+[%25level]+[%25logger]+[%25marker]+[%25thread]+-+%25msg+MDC:+{%25mdc}%25n</pattern>
++++++++</encoder>
++++</appender>|code-block|syntax|javascript|4007263|现在配置filebeat以读取这些写入目录/etc/logging的日志，作为集群中的java应用程序的sidecar运行，例如k8s|4007264|为文件节拍创建configMap：|4007265|filebeat.yml:+%7C
++++filebeat:
++++++inputs:
++++++-+type:+filestream
++++++++enabled:+true
++++++++paths:
++++++++++-+/etc/logging/*.log
++++++++++-+/etc/logging/*.log.*
++++++++prospector:
++++++++++scanner:
++++++++++++check_interval:+1s

++++++config:
++++++++inputs:
++++++++++path:+/etc/filebeat.yml
++++++++++reload:
++++++++++++enabled:+true
++++++++++++period:+10s
++++output:
++++++elasticsearch:
++++++++hosts:+[]
++++++++protocol:+
++++++++username:+
++++++++password:+|4007266|现在将其作为sidecar容器添加到原始的java应用程序中。|4007267|-+name:+filebeat-sidecar
++++++++++image:+elastic/filebeat:7.16.3
++++++++++command:+["filebeat"]
++++++++++args:+["-c","/etc/filebeat.yml","-e",+"-strict.perms=false"]
++++++++++resources:
++++++++++++limits:
++++++++++++++memory:+"80Mi"
++++++++++++requests:
++++++++++++++memory:+"60Mi"
++++++++++securityContext:
++++++++++++runAsUser:+2000
++++++++++volumeMounts:
++++++++++++-+name:+filebeat-app-logs
++++++++++++++mountPath:+/etc/logging
++++++++++++-+name:+filebeat-config
++++++++++++++mountPath:+/etc/filebeat.yml
++++++++++++++subPath:+filebeat.yml
++++++volumes:
++++++++-+name:+filebeat-app-logs
++++++++-+name:+filebeat-config
++++++++++configMap:
++++++++++++defaultMode:+0600
++++++++++++name:+filebeat-configmap
++++++++++++items:
++++++++++++++-+key:+filebeat.yml
++++++++++++++++path:+filebeat.yml|4007268|您需要将java应用程序和filebeat配置为读取日志写入的相同卷。|4007269|entityMap^0|F|K|1M|B|0|0|L|C|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|13|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|14|8|@$9|15|A|16|B|C]]|D|@]|E|$]]|$1|M|3|N|5|6|7|17|8|@]|D|@]|E|$]]|$1|O|3|P|5|H|7|18|8|@]|D|@]|E|$I|J]]|$1|Q|3|R|5|6|7|19|8|@]|D|@]|E|$]]|$1|S|3|T|5|H|7|1A|8|@]|D|@]|E|$I|J]]|$1|U|3|V|5|6|7|1B|8|@]|D|@]|E|$]]|$1|W|3|-4|5|6|7|1C|8|@]|D|@]|E|$]]]|X|$]]

You can write your application level logs via <code>RollingFileAppenders</code> using Filebeat
Add the below to your <code>logback.xml</code> to write app logs to a directory:
<pre><code> &lt;appender name=&quot;FILE&quot; class=&quot;ch.qos.logback.core.rolling.RollingFileAppender&quot;&gt;
 &lt;file&gt;/etc/logging/sample.log&lt;/file&gt;
 &lt;immediateFlush&gt;false&lt;/immediateFlush&gt;
 &lt;rollingPolicy class=&quot;ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy&quot;&gt;
 &lt;fileNamePattern&gt;
 /etc/logging/hsvt_akka.%d{yyyy-MM-dd}.%i.log.zip
 &lt;/fileNamePattern&gt;
 &lt;maxFileSize&gt;5KB&lt;/maxFileSize&gt;
 &lt;maxHistory&gt;20&lt;/maxHistory&gt;
 &lt;totalSizeCap&gt;1MB&lt;/totalSizeCap&gt;
 &lt;/rollingPolicy&gt;
 &lt;encoder&gt;
 &lt;pattern&gt;[%date{ISO8601}] [%level] [%logger] [%marker] [%thread] - %msg MDC: {%mdc}%n&lt;/pattern&gt;
 &lt;/encoder&gt;
 &lt;/appender&gt;
</code></pre>
Now configure filebeat to read these logs written to directory <code>/etc/logging</code>, running as a sidecar to your java application in the cluster, for eg k8s
Create configMap for filebeat:
<pre><code>filebeat.yml: |
 filebeat:
 inputs:
 - type: filestream
 enabled: true
 paths:
 - /etc/logging/*.log
 - /etc/logging/*.log.*
 prospector:
 scanner:
 check_interval: 1s

 config:
 inputs:
 path: /etc/filebeat.yml
 reload:
 enabled: true
 period: 10s
 output:
 elasticsearch:
 hosts: []
 protocol: 
 username: 
 password: 
</code></pre>
Now add this as a sidecar container to your original java app.
<pre><code>- name: filebeat-sidecar
 image: elastic/filebeat:7.16.3
 command: [&quot;filebeat&quot;]
 args: [&quot;-c&quot;,&quot;/etc/filebeat.yml&quot;,&quot;-e&quot;, &quot;-strict.perms=false&quot;]
 resources:
 limits:
 memory: &quot;80Mi&quot;
 requests:
 memory: &quot;60Mi&quot;
 securityContext:
 runAsUser: 2000
 volumeMounts:
 - name: filebeat-app-logs
 mountPath: /etc/logging
 - name: filebeat-config
 mountPath: /etc/filebeat.yml
 subPath: filebeat.yml
 volumes:
 - name: filebeat-app-logs
 - name: filebeat-config
 configMap:
 defaultMode: 0600
 name: filebeat-configmap
 items:
 - key: filebeat.yml
 path: filebeat.yml
</code></pre>
You need to configure the java app and filebeat to read the same volume where the logs are written to

I would like to save the log data from my Java application into an ELK stack. I can configure the format of the log data freely. Unfortunately I can only use log4j 1.x. 

What is the easiest way to store log data structured in ELK Stack?

What is the best way to write log message of my java app into the elk stack?

Elasticsearch 

容器

Java

我想将Java应用程序中的日志数据保存到ELK堆栈中。我可以自由配置日志数据的格式。不幸的是，我只能使用log4j 1.x。在ELK Stack中存储结构化日志数据的最简单方法是什么？

问将我的java应用程序的日志消息写入elk堆栈的最好方法是什么？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问将我的java应用程序的日志消息写入elk堆栈的最好方法是什么？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问将我的java应用程序的日志消息写入elk堆栈的最好方法是什么？
EN