專案地址：https://gitee.com/lwydyby/springcloud-adplatform
該專案的日誌目前可以分為三種：
(1)專案啟動日誌
(2)controller層的操作日誌（通過aop實現記錄）
(3)專案非controller層異常日誌
由於分為3種格式，則需要三種macth進行匹配：

grok {       
        match => ["message","%{TIMESTAMP_ISO8601:timestamp} \[%{NOTSPACE:thread}\] %{WORD:type}  com.gameley.common.Interceptor.HttpAspect - %{GREEDYDATA:log_json}"
 
,
        "message","%{TIMESTAMP_ISO8601:timestamp} \[%{NOTSPACE:thread}\] %{WORD:type} %{NOTSPACE:classname} \- (?<error>[\s\S]*)",
         "message","%{TIMESTAMP_ISO8601:timestamp} \[%{NOTSPACE:thread}\] %{WORD:type}  %{NOTSPACE:classname} \- %{GREEDYDATA:otherinfo}" ]
    }  

使用logstash自帶表示式的格式一般為：%{SYNTAX:SEMANTIC}
即： SYNTAX代表匹配值的型別，例如，

( ?<列名>正則表示式)

注：[\s\S]*為匹配剩餘所有的字元，我這裡是用來匹配錯誤日誌的詳細資訊的
由於controller層日誌是以json格式進行的儲存，除使用grok之外還需使用 json進行解析

  json {  
        source => "log_json"
 
  
        target => "content"  
        remove_field=>["logjson"]  
     }  

完整配置檔案為：

input {
  beats {
    port => 5044
  }
}
filter{
    grok {       
        match => ["message","%{TIMESTAMP_ISO8601:timestamp} \[%{NOTSPACE:thread}\] %{WORD:type}  com.gameley.common.Interceptor.HttpAspect - %{GREEDYDATA:log_json}",
        "message","%{TIMESTAMP_ISO8601:timestamp} \[%{NOTSPACE:thread}\] %{WORD:type} %{NOTSPACE:classname} \- (?<error>[\s\S]*)",
         "message","%{TIMESTAMP_ISO8601:timestamp} \[%{NOTSPACE:thread}\] %{WORD:type}  %{NOTSPACE:classname} \- %{GREEDYDATA:otherinfo}" ]
    }   
     json {  
        source => "log_json"  
        target => "content"  
        remove_field=>["logjson"]  
     }  
}
output {
  elasticsearch {
    hosts => ["localhost"]
    manage_template => false
    index => "%{[fields][logIndex]}-%{+YYYY.MM.dd}"
    document_type => "%{[fields][docType]}"
  }
}

除需要配置logstash之外，還需要對filebeat進行配置，以設定如何傳送日誌（處理多行日誌）：

filebeat:
  prospectors:
  -
    paths:
      - "/data/logs/*.log"
    fields:
      logIndex: userservice
      docType: springcloud
      project: adplatform
    multiline:
      pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
      negate: true
      match: after
      timeout: 5s
output:
  logstash:
    hosts: ["localhost:5044"]

日誌檔案樣例：

2018-02-22 16:09:59.876 [main] INFO  o.s.integration.channel.PublishSubscribeChannel - Channel 'user-service:dev:8763.errorChannel' has 1 subscriber(s).
2018-02-22 16:09:59.876 [main] INFO  o.s.integration.endpoint.EventDrivenConsumer - started _org.springframework.integration.errorLogger
2018-02-22 16:09:59.913 [main] INFO  o.s.i.endpoint.SourcePollingChannelAdapter - started sleuthStreamSpanReporter.poll.inboundChannelAdapter
2018-02-22 16:09:59.913 [main] INFO  o.s.context.support.DefaultLifecycleProcessor - Starting beans in phase 2147482647
2018-02-22 16:09:59.913 [main] INFO  o.s.context.support.DefaultLifecycleProcessor - Starting beans in phase 2147483647
2018-02-22 16:09:59.966 [main] INFO  org.apache.coyote.http11.Http11NioProtocol - Initializing ProtocolHandler ["http-nio-8763"]
2018-02-22 16:09:59.991 [main] INFO  org.apache.coyote.http11.Http11NioProtocol - Starting ProtocolHandler ["http-nio-8763"]
2018-02-22 16:09:59.992 [main] INFO  org.apache.tomcat.util.net.NioSelectorPool - Using a shared selector for servlet write/read
2018-02-22 16:10:00.081 [main] INFO  o.s.b.c.e.tomcat.TomcatEmbeddedServletContainer - Tomcat started on port(s): 8763 (http)
2018-02-22 16:10:00.082 [main] INFO  o.s.c.n.e.s.EurekaAutoServiceRegistration - Updating port to 8763
2018-02-22 16:10:00.088 [main] INFO  com.gameley.UserServiceApplication - Started UserServiceApplication in 281.136 seconds (JVM running for 285.806)
2018-02-22 16:10:13.234 [http-nio-8763-exec-1] INFO  o.a.c.core.ContainerBase.[Tomcat].[localhost].[/] - Initializing Spring FrameworkServlet 'dispatcherServlet'
2018-02-22 16:10:13.234 [http-nio-8763-exec-1] INFO  org.springframework.web.servlet.DispatcherServlet - FrameworkServlet 'dispatcherServlet': initialization started
2018-02-22 16:10:13.301 [http-nio-8763-exec-1] INFO  org.springframework.web.servlet.DispatcherServlet - FrameworkServlet 'dispatcherServlet': initialization completed in 67 ms
2018-02-22 16:12:26.850 [http-nio-8763-exec-10] INFO  com.gameley.common.Interceptor.HttpAspect - {"address":"http://192.168.0.43:8763/user/validate","args":"[admin, 123456]","classMethod":"com.gameley.controller.UserController.validate","httpMethod":"POST","ip":"192.168.0.43","result":"UserInfo{id='32', username='null', password='null', name='admin', description='null', updTime=null}","time":1041}
2018-02-22 16:12:27.971 [task-scheduler-5] INFO  o.s.integration.codec.kryo.CompositeKryoRegistrar - registering [40, java.io.File] with serializer org.springframework.integration.codec.kryo.FileSerializer
2018-02-22 16:12:28.276 [http-nio-8763-exec-9] INFO  com.gameley.common.Interceptor.HttpAspect - {"address":"http://192.168.0.43:8763/user/validate","args":"[admin, 123456]","classMethod":"com.gameley.controller.UserController.validate","httpMethod":"POST","ip":"192.168.0.43","result":"UserInfo{id='32', username='null', password='null', name='admin', description='null', updTime=null}","time":7}