Docker安装graylog和详解

Docker安装graylog和详解 前言

graylog我就不想介绍了，如果你看到graylog就知道它是一个日志存储服务器web

准备

安装docker
安装docker compose

1、安装graylog

mkdir -p /home/graylog/mongo_data && chmod -R +777 /home/graylog/mongo_data
mkdir -p /home/graylog/es_data && chmod -R +777 /home/graylog/es_data
mkdir -p /home/graylog/graylog_data && chmod -R +777 /home/graylog/graylog_data
mkdir -p /home/graylog/graylog_data/config && cd /home/graylog/graylog_data/config 
wget https://raw.githubusercontent.com/Graylog2/graylog-docker/4.2/config/graylog.conf
wget https://raw.githubusercontent.com/Graylog2/graylog-docker/4.2/config/log4j2.xml
chown -R 1100:1100 /home/graylog/graylog_data
cd /home/graylog
vi docker-compose.yml

设置查询高亮和国内时区

vim graylog.conf
修改 root_timezone = PRC
修改 allow_highlighting = true

version: '3'
services:
  # MongoDB: https://hub.docker.com/_/mongo/
  mongodb:
    image: mongo:4.2
    volumes:
      - /home/graylog/mongo_data:/data/db
      - /etc/localtime:/etc/localtime:ro
      - /usr/share/zoneinfo/Asia/Shanghai:/etc/timezone:ro
   # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/7.10/docker.html
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2
    volumes:
      - /home/graylog/es_data:/usr/share/elasticsearch/data
      - /etc/localtime:/etc/localtime:ro
      - /usr/share/zoneinfo/Asia/Shanghai:/etc/timezone:ro
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - TZ=Asia/Shanghai
    ulimits:
      memlock:
        soft: -1
        hard: -1
  # Graylog: https://hub.docker.com/r/graylog/graylog/
  graylog:
    image: graylog/graylog:4.2
    volumes:
      - /home/graylog/graylog_data:/usr/share/graylog/data
      - /etc/localtime:/etc/localtime:ro
      - /usr/share/zoneinfo/Asia/Shanghai:/etc/timezone:ro
    environment:
      # CHANGE ME (must be at least 16 characters)!
      - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
      # Password: admin
      - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
      - GRAYLOG_HTTP_EXTERNAL_URI=http://127.0.0.1:9000/
      - TZ=Asia/Shanghai
    entrypoint: /usr/bin/tini -- wait-for-it elasticsearch:9200 --  /docker-entrypoint.sh
    links:
        - mongodb:mongo
        - elasticsearch
    restart: always
    depends_on:
      - mongodb
      - elasticsearch
    ports:
      # Graylog web interface and REST API
      - 9000:9000
      # Syslog TCP
      - 1514:1514
      # Syslog UDP
      - 1514:1514/udp
      # GELF TCP
      - 12201:12201
      # GELF UDP
      - 12201:12201/udp

2、开始安装

docker-compose up -d 

3、浏览器中打开,密码admin/admin

http://192.168.56.100:9000/

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-W6RZbLOB-1648175335909)(imgs/image-20220221145207303.png)]

4、测试 4.1、查看运行的镜像 协议观察，可以看到12201 udp这样才算成功

docker ps

4.2、springBoot集成graylog 4.2.1、创建 gref udp input

4.2.2、使用logback进行日志的封装

	 
            de.siegmar
            logback-gelf
            2.0.0
        

	ch.qos.logback
	logback-core
	1.1.6



	ch.qos.logback
	logback-classic
	1.1.6



	ch.qos.logback
	logback-access
	1.1.6

4.2.3、springBoot配置

1、application.properties

spring.application.name=tools
server.port=8085
spring.profiles.active=prod


#log level
logging.level.root=info
logging.level.org.springframework=info
logging.level.org.mybatis=error

application-prod.properties

server.port=8080

#logging properties
logging.config=classpath:logback-prod.xml

4.2.3、logback-prod.xml 配置如下

 
        ${graylogIp}
        ${graylogPort}
        508
        true
        
            ${applicationName}-->
            false
            true
            true
            false
            false
            true
            
                %d - %m%nopex
            
            
                %d - %m%n
            
            os_arch:${os.arch}
            os_name:${os.name}
            os_version:${os.version}
        
    

或者代码添加

import ch.qos.logback.classic.AsyncAppender;
import ch.qos.logback.classic.Logger;
import ch.qos.logback.classic.LoggerContext;
import de.siegmar.logbackgelf.GelfEncoder;
import de.siegmar.logbackgelf.GelfUdpAppender;
import lombok.extern.slf4j.Slf4j;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.ApplicationArguments;
import org.springframework.boot.ApplicationRunner;
import org.springframework.stereotype.Component;


@Component
@Slf4j
public class GelfUdpAppenderRunner implements ApplicationRunner {


    @Value("${graylog.ip}")
    private String graylogIp;
    @Value("${graylog.port:12201}")
    private Integer graylogPort;

    @Value("${graylog.opened}")
    private boolean graylogOpened;
    @Value("${spring.application.name}")
    private String contextName;

    @Override
    public void run(ApplicationArguments args) throws Exception {
        if(!graylogOpened){
            return;
        }
        LoggerContext context = (LoggerContext) LoggerFactory.getILoggerFactory();
        Logger logger = context.getLogger("root");

        GelfUdpAppender gelfUdpAppender = new GelfUdpAppender();
        gelfUdpAppender.setName("graylog");
        gelfUdpAppender.setGraylogHost(graylogIp);
        gelfUdpAppender.setGraylogPort(graylogPort);
        GelfEncoder gelfEncoder = new GelfEncoder();
        gelfEncoder.setOriginHost(contextName);
        gelfEncoder.setContext(context);
        gelfEncoder.start();
        gelfUdpAppender.setEncoder(gelfEncoder);
        gelfUdpAppender.setContext(context);
        gelfUdpAppender.start();
        // Atach appender to logger
        logger.addAppender(gelfUdpAppender);

        AsyncAppender asyncAppender = new AsyncAppender();
        asyncAppender.setContext(context);
        asyncAppender.setName("async");
        asyncAppender.setQueueSize(1024);
        asyncAppender.setDiscardingThreshold(-1);
        asyncAppender.setIncludeCallerData(true);
        asyncAppender.addAppender(gelfUdpAppender);
        asyncAppender.start();


         log.info("gelfUdpAppender启动完成");
    }
}

4.2.4、测试controller，下面有个异常哦

@Slf4j
@RestController
public class TestController {
    @GetMapping("log")
    public String log(){

        log.error("error");
        log.warn("warn");
        log.info("info");
        log.debug("debug");
        int i = 1/0;
        return "success";
    }
}

5、开始启动springBoot的朋友们。观察浏览器graylog
可以看到日志和控制台是一样的

4.2.4、日志保留时间

默认保留时间