原理及效果

​ logstash支持从tcp输入，logback支持logstash appender，日志可以不打到文件直接打到logstash。方便集成ELK，且不挂载docker卷情况下镜像也不会增大。

步骤

应用-添加maven依赖

	<dependency>
		<groupId>net.logstash.logback</groupId>
		<artifactId>logstash-logback-encoder</artifactId>
		<version>4.11</version>
	</dependency>

应用-logback-spring.xml添加appender

    <appender name="logstash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <!--可以访问的logstash日志收集端口-->
        <destination>127.0.0.1:8888</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder"/>
        <encoder class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <providers>
                <timestamp>
                    <timeZone>Asia/Shanghai</timeZone>
                </timestamp>
                <pattern>
                    <pattern>
                        {
                        "time":"%d{yyyy-MM-dd HH:mm:ss}",
                        "level": "%level",
                        "thread": "%thread",
                        "class": "%c[%L]",
                        "message": "%msg"
                        }
                    </pattern>
                </pattern>
            </providers>
        </encoder>
    </appender>

    <!-- 日志输出级别 -->
    <root level="INFO">
        <appender-ref ref="logstash" />
    </root>

logstash.conf

## 从tcp 8888端口输入
input {
    tcp {
        mode => "server"
        port => 8888
    }
}
filter {
    json {
       source => "message"
    }
 }
## 控制台输出,测试用。也可以打到es
output {
    stdout {
        codec => rubydebug
    }
}