graylog官網(wǎng)

官網(wǎng)地址https://www.graylog.org/

graylog1.png

支持多種安裝方式匣吊，我選擇了RPM安裝

image.png

安裝條件

• java8以上
• Elasticsearch5.x以上或6.x以上
• MongoDB大于等于3.6
• 不能使用Elasticsearch7.x版本

Linux版本的話基本沒問題繁仁，我使用的是CentOS7.4

安裝MongoDB

mongodb我使用docker安裝袁串，因?yàn)間raylog的一些配置信息會(huì)存儲(chǔ)到mongodb中节吮，所以mongodb用的不是很多欠母。

下載鏡像

docker pull mongo:4

啟動(dòng)mongodb

docker run \
 -p 27017:27017 \
 -v $PWD/db:/data/db \
 -d mongo:4

安裝Elasticsearch

rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
vim /etc/yum.repos.d/elasticsearch.repo
[elasticsearch-6.x]
name=Elasticsearch repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

安裝

yum install elasticsearch

啟動(dòng)

systemctl start elasticsearch
systemctl enable elasticsearch

安裝Graylog3

rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-3.0-repository_latest.rpm
yum install graylog-server -y

安裝pwgen

yum install pwgen -y

修改配置文件

vim /etc/graylog/server/server.conf

image.png

配置文件中要求必須設(shè)置password_secret爬早，使用pwgen生成

image.png

使用echo -n yourpassword | shasum -a 256設(shè)置一下admin賬戶的密碼

root_timezone = Asia/Shanghai
http_bind_address = 0.0.0.0:9000
http_publish_uri = http://公網(wǎng)ip:9000/
elasticsearch_hosts = http://127.0.0.1:9200
elasticsearch_shards =1 
elasticsearch_replicas = 0
mongodb_uri = mongodb://127.0.0.1:27017/graylog

可自行設(shè)置郵件通知的參數(shù)

# Email transport
#transport_email_enabled = false
#transport_email_hostname = mail.example.com
#transport_email_port = 587
#transport_email_use_auth = true
#transport_email_auth_username = you@example.com
#transport_email_auth_password = secret
#transport_email_subject_prefix = [graylog]
#transport_email_from_email = graylog@example.com

啟動(dòng)graylog

systemctl start graylog-server
systemctl enable graylog-server

使用graylog

地址：公網(wǎng)ip:9000

image.png

添加一個(gè)input

image.png

image.png

image.png

image.png

spring cloud中集成graylog

引入依賴

<dependency>
  <groupId>de.siegmar</groupId>
  <artifactId>logback-gelf</artifactId>
  <version>2.0.1</version>
</dependency>

在logback.xml文件中添加

<appender name="GELF" class="de.siegmar.logbackgelf.GelfUdpAppender">
  <graylogHost>localhost</graylogHost>
  <graylogPort>12201</graylogPort>
  <maxChunkSize>508</maxChunkSize>
  <useCompression>true</useCompression>
        <encoder class="de.siegmar.logbackgelf.GelfEncoder">
            <!--<originHost>localhost</originHost>-->
            <includeRawMessage>false</includeRawMessage>
            <includeMarker>true</includeMarker>
            <includeMdcData>true</includeMdcData>
            <includeCallerData>false</includeCallerData>
            <includeRootCauseData>false</includeRootCauseData>
            <includeLevelName>false</includeLevelName>
            <shortPatternLayout class="ch.qos.logback.classic.PatternLayout">
                <pattern>%m%nopex</pattern>
            </shortPatternLayout>
            <fullPatternLayout class="ch.qos.logback.classic.PatternLayout">
                <pattern>%m%n</pattern>
            </fullPatternLayout>
            <staticField>app_name:host</staticField>
            <staticField>os_arch:${os.arch}</staticField>
            <staticField>os_name:${os.name}</staticField>
            <staticField>os_version:${os.version}</staticField>
        </encoder>
</appender>

graylogHost為graylog服務(wù)器ip
graylogPort為udp端口號
originHost不設(shè)置的話自動(dòng)會(huì)顯示服務(wù)器ip
app_name為應(yīng)用名稱氯夷，建議設(shè)置一下，后面可以使用應(yīng)用名稱過濾

添加輸入配置

<root level="info">
  <appender-ref ref="consoleAppender" />
  <appender-ref ref="GELF" />
</root>

啟動(dòng)項(xiàng)目后撼短，即可以看到日志了

image.png

在日常使用中我們需要對生產(chǎn)環(huán)境的日志進(jìn)行監(jiān)控再膳，而開發(fā)環(huán)境是不需要的，如何做多環(huán)境配置呢曲横？
在spring boot啟動(dòng)yml文件中添加配置

logging:
  config: classpath:logback-${spring.cloud.config.profile}.xml

image.png

配置多份logback.xml后達(dá)到了動(dòng)態(tài)實(shí)現(xiàn)生產(chǎn)環(huán)境進(jìn)行g(shù)raylog日志監(jiān)控喂柒。