1、更改logstash的啟動配置檔案資訊如下，開發9000埠

input {  
    tcp {
            port => 9000
            codec => "json"

      } 
    file {
        path => "/usr/share/tomcat/logs/*.log"
        start_position => beginning
    }
}
filter {
 
}
output {
    elasticsearch {
    hosts => "localhost:9200"
    }
 
}
 

重新啟動

2、引入包

<!--        ELK-->
        <dependency>
            <groupId>net.logstash.logback</groupId>
            <artifactId>logstash-logback-encoder</artifactId>
            <version>4.9</version>
        </dependency>

3、增加logback-spring.xml

<?xml version="
 
1.0" encoding="UTF-8"?>
<configuration debug="false">
    <!--定義日誌檔案的儲存地址 勿在 LogBack 的配置中使用相對路徑-->
    <property name="LOG_HOME" value="./logs" />
    <!-- 控制檯輸出 -->
    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder
 
">
            <!--格式化輸出：%d表示日期，%thread表示執行緒名，%-5level：級別從左顯示5個字元寬度%msg：日誌訊息，%n是換行符-->
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{50} - %msg  %n</pattern>
        </encoder>
    </appender>

    <appender name="logstash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <param name="Encoding" value="UTF-8"/>
        <destination>192.168.0.189:9000</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder" >
            <customFields>{"appname":"elkDemo"}</customFields>
        </encoder>
    </appender>


    <!-- 日誌輸出級別 -->
    <root level="INFO">
        <appender-ref ref="STDOUT" />
        <appender-ref ref="logstash" />
    </root>

</configuration>

4、可以去Kibana裡面去折騰了，可以找到了應該