JBoss/WildFly Logstash

我一直无法将我们的Wildfly日志放到Logstash/Kibana服务器上 Wildfly和logstash/kibana都在Ubuntu AWS服务器上

/etc/opt/logstash.conf

input {
  file {
    type => "webapplog"
    path => "/home/ubuntu/app/log/logstash.json"
    codec => "json"
    tags => [ "tariff-engine" ]
  }
}

output {
  redis { 
    host => "redis.mvp.enernoc.net"
    data_type => "list"
    batch => true
    congestion_threshold => 1000
    key => "logstash"
  }
}

/home/ubuntu/app/config/logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration>

    <appender name="logstash" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
            <level>INFO</level>
        </filter>
        <file>/home/ubuntu/app/log/logstash.json</file>
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>/home/ubuntu/app/log/logstash.json.%d{yyyy-MM-dd}            </fileNamePattern>
            <maxHistory>7</maxHistory>
        </rollingPolicy>
    <encoder class="net.logstash.logback.encoder.LogstashEncoder" />
    </appender>

    <root level="INFO">
        <appender-ref ref="logstash" />
    </root>

</configuration>

我尝试过使用jboss-deployment-structure.xml 在日志子系统上有排除，没有评估

还要注意，jboss.log /home/ubuntu/app/app 包含所有日志记录，而

---

logstash.json为空

您也可以使用本机GELF，而不是绕道文件。logstash提供GELF输入

日志存储输入

input { gelf {} }}

它接受UDP数据流。GELF库有用于logback的连接器和用于JBoss/WildFly的连接器。JBoss和应用程序的日志可以通过相同的通道发送，因此不再需要解析日志文件

回登录配置

<configuration>
   ...
    <appender name="gelf" class="biz.paluch.logging.gelf.logback.GelfLogbackAppender">
        <host>udp:localhost</host>
        <port>12201</port>
        ...
        <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
            <level>INFO</level>
        </filter>
    </appender>
    ...
</configuration>

...
udp:本地主机
12201
...
信息
...

为了实现这一点，我更喜欢使用内置的WildFly日志记录

可以轻松用作WildFly自定义格式化程序，以logstash的JSON格式输出日志。请注意，这个项目（目前）尚未发布到Maven Central，因此您必须自己构建JAR

安装步骤：

构建SYNAXON/logstash util格式化程序

将logstash-util-formatter-1.0.jar复制到[wildfly dir]/modules/system/layers/base/net/logstash/main

创建[wildfly dir]/modules/system/layers/base/net/logstash/main/module.xml：

<?xml version="1.0" encoding="UTF-8"?>
<module xmlns="urn:jboss:module:1.1" name="net.logstash">
    <resources>
        <resource-root path="logstash-util-formatter-1.0.jar" />
    </resources>
    <dependencies>
        <module name="javax.json.api"/>
    </dependencies>
</module>

更新您的standalone.xml：

....
<!-- Could also be file-handler or size-rotating-file-handler -->
<periodic-rotating-file-handler name="LOGSTASH"
        autoflush="true">
    <level name="INFO" />
    <formatter>
        <named-formatter name="LOGSTASH-PATTERN" />
    </formatter>
    <file relative-to="jboss.server.log.dir" path="logstash.log" />
    <suffix value=".yyyy-MM-dd" />
    <append value="true" />
</periodic-rotating-file-handler>
....
<root-logger>
    <level name="INFO"/>
    <handlers>
        <handler name="CONSOLE"/>
        <handler name="FILE"/>
        <handler name="LOGSTASH" />
    </handlers>
</root-logger>
....
<formatter name="LOGSTASH-PATTERN">
    <custom-formatter class="net.logstash.logging.formatter.LogstashUtilFormatter" module="net.logstash"/>
</formatter>
....

。。。。
....
....
....

---

我认为这是我们的logback.xml问题。logstash.json为空，必须是logstash无法读取任何日志。

....
<!-- Could also be file-handler or size-rotating-file-handler -->
<periodic-rotating-file-handler name="LOGSTASH"
        autoflush="true">
    <level name="INFO" />
    <formatter>
        <named-formatter name="LOGSTASH-PATTERN" />
    </formatter>
    <file relative-to="jboss.server.log.dir" path="logstash.log" />
    <suffix value=".yyyy-MM-dd" />
    <append value="true" />
</periodic-rotating-file-handler>
....
<root-logger>
    <level name="INFO"/>
    <handlers>
        <handler name="CONSOLE"/>
        <handler name="FILE"/>
        <handler name="LOGSTASH" />
    </handlers>
</root-logger>
....
<formatter name="LOGSTASH-PATTERN">
    <custom-formatter class="net.logstash.logging.formatter.LogstashUtilFormatter" module="net.logstash"/>
</formatter>
....