## 一、開啟審計日志功能 確保功能開啟，并生成出審計日志，具體參考：[開發說明-基礎功能-審計日志](http://www.hmoore.net/zlt2000/microservices-platform/1224748#_94)  ## 二、ELK部署 相關信息請查看[統一日志中心詳解](http://www.hmoore.net/zlt2000/microservices-platform/919434) ## 三、定義es索引模板 執行下面的ssh腳本創建`審計日志`的索引模板，ip改為自己的服務器地址 ~~~ curl -XPUT http://192.168.28.130:9200/_template/template_audit_log -H 'Content-Type: application/json' -d ' { "index_patterns" : ["audit-log-*"], "order" : 0, "settings" : { "number_of_replicas" : 0 }, "mappings": { "doc": { "properties": { "operation": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } }, "analyzer": "ik_max_word" } } } } }' ~~~ ## 四、Logstash配置 ### 4.1. 修改10-syslog.conf配置，在filter里增加以下內容 如下圖 就不是根據空格，而是 | 號分隔 ~~~ if [fields][docType] == "audit-log" { grok { patterns_dir => ["/opt/logstash/patterns"] match => { "message" => "%{TIMESTAMP_ISO8601:logTime}\|%{MYAPPNAME:appName}\|%{MYTHREADNAME:className}\|%{WORD:methodName}\|%{MYAPPNAME:userId}\|%{MYAPPNAME:userName}\|%{MYAPPNAME:clientId}\|%{GREEDYDATA:operation}" } } date { match => ["logTime","yyyy-MM-dd HH:mm:ss.SSS Z"] } date { match => ["logTime","yyyy-MM-dd HH:mm:ss.SSS"] target => "timestamp" locale => "en" timezone => "+08:00" } mutate { remove_field => "message" remove_field => "logTime" remove_field => "@version" remove_field => "host" remove_field => "offset" } } ~~~ ### 4.2. 修改30-output.conf配置，增加以下內容 ~~~ if [fields][docType] == "audit-log" { elasticsearch { hosts => ["localhost"] manage_template => false index => "audit-log-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } } ~~~ ## 五、Filebeat配置 修改配置文件`filebeat.yml`，在`filebeat.inputs`里添加以下內容，抓取日志內容 ~~~ - type: log enabled: true paths: - D:\workspaces\projects\logs\audit\*.log fields: docType: audit-log project: microservices-platform ~~~ ## 六、查看數據 配置好elk之后日志數據就能同步到es了并自動創建索引  通過頁面展示數據