elk日志使用

elasticsearch +log4net.ElasticSearch+kibana(windows)

  • 需要的东西(目前用的5.6版本)

       1.先安装jdk和jre 配置java环境
       2. 下载elasticsearch ,运行elasticsearch-5.6.16\bin\elasticsearch.bat 启动es,端口默认9200;(执行elasticsearch-service.bat install 设置为windows服务)
       3.下载kibana,运行kibana-5.6.16-windows-x86\bin\kibana.bat 启动kibana 端口默认5601;(执行 nssm install kibana,设置kibana路径,设置为windows服务,需要下载nssm)
       4.定时删除es索引;删除es索引\deleteIndex\delete.ext程序附加到windows任务计划程序,设置每天跑一次

var url=  ConfigurationManager.AppSettings["EsUrl"];
                var indexs = ConfigurationManager.AppSettings["EsIndex"];
                var day=int.Parse(ConfigurationManager.AppSettings["ESdeleteDay"]);
                log.Info($"url:{url};索引:{indexs};删除天数:{day}");
                var nodes = new Uri(url);
                var client = new ElasticClient(nodes);
                var index = indexs.Split(',');
                var time = DateTime.Now;
                foreach (var item in index)
                {
                    var logindex=item+"-"+time.AddDays(day * -1).ToString("yyyy.MM.dd");
                    var result = client.DeleteIndex(logindex);
                    if (result.ApiCall.Success)
                    {
                        log.Info($"已删除索引:{logindex}");
                    }
                }
  • 写入日志到es

      log4net.ElasticSearch基于log4net,基本无缝对接log4net,只需要更改log4net.config配置即可

 <log4net>
    <root>
      <level value="All" />
      <!--记录到es-->
      <appender-ref ref="ElasticSearchAppender" />
    </root>
    <appender name="ElasticSearchAppender" type="log4net.ElasticSearch.ElasticSearchAppender, log4net.ElasticSearch">
      <layout type="log4net.Layout.PatternLayout,log4net">
        <param name="ConversionPattern" value="%d{ABSOLUTE} %-5p %c{1}:%L - %m%n" />
      </layout>

      <connectionString value="Server=localhost;Index=pxin_log;Port=9200;rolling=true"/>

      <lossy value="false" />
<!-- 相当于缓存池,满10个才写入es-->
      <bufferSize value="10" />

      <evaluator type="log4net.Core.LevelEvaluator">
<!-- 异常级别直接写入es-->
        <threshold value="ERROR"/>
      </evaluator>
    </appender>
</root>
</log4net>

  

上一篇:netcore 调用log4net


下一篇:第一章节概述