使用filebeat收集并解析springboot日志过程示例

wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.9.0-linux-x86_64.tar.gz

filebeat.inputs:
  - type: log
    paths:
      - "/data/logs/*/error.log"
    document_type: json
    json.message_key: log
    json.keys.under_root: true
    json.overwrite_keys: true
    fields:
      logType: errJson
    fields_under_root: true

<property name="FILE_LOG_PATTERN" value="${FILE_LOG_PATTERN:-%d{${LOG_DATEFORMAT_PATTERN:-yyyy-MM-dd HH:mm:ss.SSS}} ${LOG_LEVEL_PATTERN:-%5p} ${PID:- } --- [%t] %-40.40logger{39} : %m%n${LOG_EXCEPTION_CONVERSION_WORD:-%wEx}}"/>

filebeat.inputs:
- type: stdin
  processors:
    - dissect:
        tokenizer: "%{logDate} %{logTime}  %{logLevel} %{pid} --- [%{thread}] %{logger} : %{message}"
        field: "message"
output.console:
  enabled: true
  pretty: true

{
  "@timestamp": "2023-08-05T12:53:28.738Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "8.9.0"
  },
  "log": {
    "offset": 0,
    "file": {
      "path": ""
    }
  },
  "message": "2023-08-05 20:47:11.069  INFO 3396 --- [           main] org.example.Main                         : Started Main in 1.662 seconds (JVM running for 2.228)",
  "input": {
    "type": "stdin"
  },
  "dissect": {
    "logTime": "20:47:11.069",
    "logLevel": "INFO",
    "pid": "3396",
    "thread": "           main",
    "logger": "org.example.Main                        ",
    "message": "Started Main in 1.662 seconds (JVM running for 2.228)",
    "logDate": "2023-08-05"
  },
  "agent": {
    "name": "dembp",
    "type": "filebeat",
    "version": "8.9.0",
    "ephemeral_id": "4e4a9ee3-4682-41ab-ad9b-f4821543d991",
    "id": "597a1a87-8165-492b-a9e8-d6530376b179"
  },
  "ecs": {
    "version": "8.0.0"
  },
  "host": {
    "name": "dembp"
  }
}

filebeat.inputs:
- type: stdin
  multiline:
    pattern: '^\d{4}-\d{2}-\d{2}'
    negate: true
    match: after

output:
  logstash:
    hosts: ["192.168.99.100:5044"]

output.elasticsearch:
  hosts: ["192.168.99.100:9200"]
  username: "xxxx"
  password: "xxxx"