在云启用应用程序中使用 Log4j

{
    "version": "1.1",
    "host": "${hostName}",
    "short_message": {
        "$resolver": "message",
        "stringified": true
    },
    "full_message": {
        "$resolver": "message",
        "pattern": "[%t] %-5p %X{requestId, sessionId, loginId, userId, ipAddress, corpAcctNumber} %C{1.}.%M:%L - %m",
        "stringified": true
    },
    "timestamp": {
        "$resolver": "timestamp",
        "epoch": {
            "unit": "secs"
        }
    },
    "level": {
        "$resolver": "level",
        "field": "severity",
        "severity": {
            "field": "code"
        }
    },
    "_logger": {
        "$resolver": "logger",
        "field": "name"
    },
    "_thread": {
        "$resolver": "thread",
        "field": "name"
    },
    "_mdc": {
        "$resolver": "mdc",
        "flatten": {
            "prefix": "_"
        },
        "stringified": true
    }
}

<Socket name="Elastic"
        host="\${sys:logstash.search.host}"
        port="12222"
        protocol="tcp"
        bufferedIo="true">
  <JsonTemplateLayout eventTemplateUri="classpath:EnhancedGelf.json" nullEventDelimiterEnabled="true">
    <EventTemplateAdditionalField key="containerId" value="${docker:containerId:-}"/>
    <EventTemplateAdditionalField key="application" value="${lower:${spring:spring.application.name:-spring}}"/>
    <EventTemplateAdditionalField key="kubernetes.serviceAccountName" value="${k8s:accountName:-}"/>
    <EventTemplateAdditionalField key="kubernetes.containerId" value="${k8s:containerId:-}"/>
    <EventTemplateAdditionalField key="kubernetes.containerName" value="${k8s:containerName:-}"/>
    <EventTemplateAdditionalField key="kubernetes.host" value="${k8s:host:-}"/>
    <EventTemplateAdditionalField key="kubernetes.labels.app" value="${k8s:labels.app:-}"/>
    <EventTemplateAdditionalField key="kubernetes.labels.pod-template-hash" value="${k8s:labels.podTemplateHash:-}"/>
    <EventTemplateAdditionalField key="kubernetes.master_url" value="${k8s:masterUrl:-}"/>
    <EventTemplateAdditionalField key="kubernetes.namespaceId" value="${k8s:namespaceId:-}"/>
    <EventTemplateAdditionalField key="kubernetes.namespaceName" value="${k8s:namespaceName:-}"/>
    <EventTemplateAdditionalField key="kubernetes.podID" value="${k8s:podId:-}"/>
    <EventTemplateAdditionalField key="kubernetes.podIP" value="${k8s:podIp:-}"/>
    <EventTemplateAdditionalField key="kubernetes.podName" value="${k8s:podName:-}"/>
    <EventTemplateAdditionalField key="kubernetes.imageId" value="${k8s:imageId:-}"/>
    <EventTemplateAdditionalField key="kubernetes.imageName" value="${k8s:imageName:-}"/>
  </JsonTemplateLayout>
</Socket>

{
  "@timestamp": {
    "$resolver": "timestamp",
    "pattern": {
      "format": "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'",
      "timeZone": "UTC"
    }
  },
  "ecs.version": "1.11.0",
  "log.level": {
    "$resolver": "level",
    "field": "name"
  },
  "application": "\${lower:\${spring:spring.application.name}}",
  "short_message": {
    "$resolver": "message",
    "stringified": true
  },
  "message": {
    "$resolver": "pattern",
    "pattern": "[%t] %X{requestId, sessionId, loginId, userId, ipAddress, accountNumber} %C{1.}.%M:%L - %m%n"
  },
  "process.thread.name": {
    "$resolver": "thread",
    "field": "name"
  },
  "log.logger": {
    "$resolver": "logger",
    "field": "name"
  },
  "event.action": {
    "$resolver": "marker",
    "field": "name"
  },
  "event.data": {
    "$resolver": "map",
    "stringified": true
  },
  "labels": {
    "$resolver": "mdc",
    "flatten": true,
    "stringified": true
  },
  "tags": {
    "$resolver": "ndc"
  },
  "error.type": {
    "$resolver": "exception",
    "field": "className"
  },
  "error.message": {
    "$resolver": "exception",
    "field": "message"
  },
  "error.stack_trace": {
    "$resolver": "exception",
    "field": "stackTrace",
    "stackTrace": {
      "stringified": true
    }
  }
}

<Socket name="Elastic" host="${sys:elastic.search.host}" port="12222" protocol="tcp" bufferedIo="true">
  <GelfLayout includeStackTrace="true" host="${hostName}" includeThreadContext="true" includeNullDelimiter="true"
              compressionType="OFF">
    <ThreadContextIncludes>requestId,sessionId,loginId,userId,ipAddress,callingHost</ThreadContextIncludes>
    <MessagePattern>%d [%t] %-5p %X{requestId, sessionId, loginId, userId, ipAddress} %C{1.}.%M:%L - %m%n</MessagePattern>
    <KeyValuePair key="containerId" value="${docker:containerId:-}"/>
    <KeyValuePair key="application" value="${lower:${spring:spring.application.name:-spring}}"/>
    <KeyValuePair key="kubernetes.serviceAccountName" value="${k8s:accountName:-}"/>
    <KeyValuePair key="kubernetes.containerId" value="${k8s:containerId:-}"/>
    <KeyValuePair key="kubernetes.containerName" value="${k8s:containerName:-}"/>
    <KeyValuePair key="kubernetes.host" value="${k8s:host:-}"/>
    <KeyValuePair key="kubernetes.labels.app" value="${k8s:labels.app:-}"/>
    <KeyValuePair key="kubernetes.labels.pod-template-hash" value="${k8s:labels.podTemplateHash:-}"/>
    <KeyValuePair key="kubernetes.master_url" value="${k8s:masterUrl:-}"/>
    <KeyValuePair key="kubernetes.namespaceId" value="${k8s:namespaceId:-}"/>
    <KeyValuePair key="kubernetes.namespaceName" value="${k8s:namespaceName:-}"/>
    <KeyValuePair key="kubernetes.podID" value="${k8s:podId:-}"/>
    <KeyValuePair key="kubernetes.podIP" value="${k8s:podIp:-}"/>
    <KeyValuePair key="kubernetes.podName" value="${k8s:podName:-}"/>
    <KeyValuePair key="kubernetes.imageId" value="${k8s:imageId:-}"/>
    <KeyValuePair key="kubernetes.imageName" value="${k8s:imageName:-}"/>
  </GelfLayout>
</Socket>

input {
  tcp {
    port => 12345
    codec => "json"
  }
}

output {

  # (Un)comment for debugging purposes.
  # stdout { codec => rubydebug }

  # Modify the hosts value to reflect where elasticsearch is installed.
  elasticsearch {
    hosts => ["http://localhost:9200/"]
    index => "app-%{application}-%{+YYYY.MM.dd}"
  }

}

   filter {
     # These are GELF/Syslog logging levels as defined in RFC 3164. Map the integer level to its human readable format.
     translate {
       field => "[level]"
       destination => "[levelName]"
       dictionary => {
         "0" => "EMERG"
         "1" => "ALERT"
         "2" => "CRITICAL"
         "3" => "ERROR"
         "4" => "WARN"
         "5" => "NOTICE"
         "6" => "INFO"
         "7" => "DEBUG"
       }
     }
   }

   output {
     # (Un)comment for debugging purposes
     # stdout { codec => rubydebug }
     # Modify the hosts value to reflect where elasticsearch is installed.
     elasticsearch {
       hosts => ["http://localhost:9200/"]
       index => "app-%{application}-%{+YYYY.MM.dd}"
     }
   }

filebeat.inputs:
- type: log
  enabled: true
  json.keys_under_root: true
  paths:
    - /var/log/apps/*.log