Nodejs Express 通過log4js寫日志到Logstash(ELK)

2019-11-19 13:06:04

字體：大中小

供稿：網(wǎng)友

Log4j 是一個(gè)使用 Java 語言編寫的，可靠、快速、靈活的日志框架（API），使用 Apache Software License 授權(quán)。它被移植到 C、C++、C#、Perl、Python、Ruby 和 Eiffel 語言中。

Log4j 是高度可配置的，在運(yùn)行期使用外部的配置文件對(duì)其進(jìn)行配置。它按照優(yōu)先級(jí)別記錄日志，并可將日志信息定向輸出到各種介質(zhì)，比如數(shù)據(jù)庫、文件、控制臺(tái)、Unix Syslog等。

Log4j 主要由三部分組成：

loggers：負(fù)責(zé)采集日志信息。
appenders：負(fù)責(zé)將日志信息發(fā)布到不同地方。
layouts：負(fù)責(zé)以各種風(fēng)格格式化日志信息。

確認(rèn)版本

 "dependencies": {  "body-parser": "1.18.3",  "compression": "1.7.2",  "cookie-parser": "1.4.3",  "ejs": "2.6.1",  "express": "4.16.3",  "forever": "0.15.3",  "http-proxy-middleware": "0.18.0",  "log4js": "2.9.0",  "log4js-logstash-tcp": "1.0.1",  "serve-favicon": "2.5.0" },

Logstash配置

你需要知道logstash服務(wù)的IP和端口
你需要知道寫日志是通過什么協(xié)議：TCP，還是UDP

在我向logstash寫日志之前，已經(jīng)有同事向Logstash寫過日志了。當(dāng)時(shí)只是知道logstash的ip和端口，沒有搞清楚協(xié)議，所以沒有寫進(jìn)去。

logger

// filename: /logs/logger.jsvar log4js = require('log4js')// 獲取配置文件中l(wèi)ogstash的IP地址和端口var {logHost, logPort} = require('../config/index.js') if (!logHost || !logPort) { console.log('ERROR not config logstash_host or logstash_port')}log4js.configure({ appenders: {  console: { type: 'console' },  logstash: {   // 因?yàn)槲覀兊膌ogstash暴露的是tcp寫日志的端口，所以我用了log4js-logstash-tcp，   // 這個(gè)需要安裝 https://github.com/Aigent/log4js-logstash-tcp   // 如果你的logstash使用UDP的，參考 https://github.com/log4js-node/logstashUDP   type: 'log4js-logstash-tcp',    host: logHost,   port: parseInt(logPort)  } }, categories: {  default: { appenders: ['logstash'], level: 'debug' } }})const logger = log4js.getLogger('default')

app.js

// filename: /app.jsvar express = require('express')var compression = require('compression')var path = require('path')var log4js = require('log4js')var proxyMiddleware = require('http-proxy-middleware')var cookieParser = require('cookie-parser')var logger = require('./logs/logger.js') // 這了引用了上面的loggervar {proxyTable, maxAge} = require('./config/index.js')...Object.keys(proxyTable).forEach(function (context) { if (!proxyTable[context].ws) {  // 這里我是用的反向代理，當(dāng)代理響應(yīng)時(shí)，開始寫日志  proxyTable[context].onProxyRes = writeLog } app.use(proxyMiddleware(context, proxyTable[context]))})...// 主要謝日日志的就是這里function writeLog (proxyRes, req, res) { var baseLog = `${req.method} ${proxyRes.statusCode} ${req.cookies.email} ${req.url}` var msgObj = {  method: req.method,  statusCode: proxyRes.statusCode,  url: req.url,  email: req.cookies.email || '',  sessionId: req.cookies.sessionId || '',  instanceId: 'newTm',  nodeName: 'newTm' } if (proxyRes.statusCode < 400) {  logger.info(baseLog, msgObj) } else {  logger.error(baseLog, msgObj) }}

在kibana中輸入關(guān)鍵詞：nodeName:newTm

可以搜到如下的記錄

{ "_index": "logstash-2018.07.11", "_type": "logs", "_id": "AWSIGyY0vR6RLdfU8xZj", "_score": null, "_source": {  "nodeName": "newTm",  "method": "GET",  "level": "INFO",  "sessionId": "",  "message": "GET 204 test.cc.com /api/touch?_=1531291286527",  "url": "/api/touch?_=1531291286527",  "@timestamp": "2018-07-11T06:53:29.059Z",  "port": 57250,  "@version": "1",  "host": "192.168.2.74",  "fields": {   "nodeName": "newTm",   "method": "GET",   "level": "INFO",   "sessionId": "",   "category": "default",   "url": "/api/touch?_=1531291286527",   "email": "test.cc.com",   "statusCode": 204  },  "category": "default",  "email": "test.cc.com",  "statusCode": 204 }, "fields": {  "@timestamp": [   1531292009059  ] }, "highlight": {  "nodeName": [   "@kibana-highlighted-field@newTm@/kibana-highlighted-field@"  ] }, "sort": [  1531292009059 ]}

注意