1. 配置log4j.properties

log4j.rootLogger=INFO,DEBUG,logstashlog4j.appender.logstash=org.apache.log4j.net.SocketAppenderlog4j.appender.logstash.Port=4560log4j.appender.logstash.RemoteHost=10.0.0.5log4j.appender.logstash.ReconnetionDelay=60000log4j.appender.logstash.LocationInfo=true

2. 修改logstash input组件(favblog-log4j.conf)，将日志输出到Elasticsearch

input{log4j{host=>"10.0.0.5"mode=>"server"type=>"log4j-json"port=>4560}}output{stdout{codec=>rubydebug}elasticsearch{hosts=>["10.0.0.5:9200"]}}

3.启动Logstash

[root@Serverbin]#./logstash-ffavblog-log4j.confSettings:Defaultpipelineworkers:4log4j:WARNNoappenderscouldbefoundforlogger(org.apache.http.client.protocol.RequestAuthCache).log4j:WARNPleaseinitializethelog4jsystemproperly.log4j:WARNSeehttp://logging.apache.org/log4j/1.2/faq.html#noconfigformoreinfo.Pipelinemainstarted{"message"=>"*************************************Hellotest!","@version"=>"1","@timestamp"=>"2016-05-31T07:24:34.989Z","timestamp"=>1464679190253,"path"=>"com.favccxx.favblog.platform.interceptor.FavInterceptor","priority"=>"INFO","logger_name"=>"com.favccxx.favblog.platform.interceptor.FavInterceptor","thread"=>"http-bio-8080-exec-2","class"=>"com.favccxx.favblog.platform.interceptor.FavInterceptor","file"=>"AppAuthorityInterceptor.java:65","method"=>"intercept","host"=>"10.0.0.115:54930","type"=>"log4j-json"}{"message"=>"**errorInvokeKey:[MBGL-S]QemI2gBhHC","@version"=>"1","@timestamp"=>"2016-05-31T07:24:35.000Z","timestamp"=>1464679190264,"path"=>"com.favccxx.favblog.platform.interceptor.FavInterceptor","priority"=>"ERROR","logger_name"=>"com.favccxx.favblog.platform.interceptor.FavInterceptor","thread"=>"http-bio-8080-exec-2","class"=>"com.favccxx.favblog.platform.interceptor.FavInterceptor","file"=>"AppAuthorityInterceptor.java:140","method"=>"intercept","host"=>"10.0.0.115:54930","type"=>"log4j-json"}{"message"=>"Exceptionoccurredduringprocessingrequest:Cannotcreateasessionaftertheresponsehasbeencommitted","@version"=>"1","@timestamp"=>"2016-05-31T07:24:35.023Z","timestamp"=>1464679190280,"path"=>"org.apache.struts2.dispatcher.DefaultDispatcherErrorHandler","priority"=>"ERROR","logger_name"=>"org.apache.struts2.dispatcher.DefaultDispatcherErrorHandler","thread"=>"http-bio-8080-exec-2","class"=>"com.opensymphony.xwork2.util.logging.commons.CommonsLogger","file"=>"CommonsLogger.java:42","method"=>"error","stack_trace"=>"java.lang.IllegalStateException:Cannotcreateasessionaftertheresponsehasbeencommitted\n\tatorg.apache.catalina.connector.Request.doGetSession(Request.java:3013)\n\tatorg.apache.catalina.connector.Request.getSession(Request.java:2385)\n\tatorg.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:897)\n\tatjavax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:229)\n\tatorg.apache.struts2.dispatcher.SessionMap.put(SessionMap.java:182)\n\tatorg.apache.struts2.interceptor.MessageStoreInterceptor.after(MessageStoreInterceptor.java:297)\n\tatorg.apache.struts2.interceptor.MessageStoreInterceptor.intercept(MessageStoreInterceptor.java:198)\n\tatcom.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:244)\n\tatorg.apache.struts2.impl.StrutsActionProxy.execute(StrutsActionProxy.java:54)\n\tatorg.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:564)\n\tatorg.apache.struts2.dispatcher.ng.ExecuteOperations.executeAction(ExecuteOperations.java:81)\n\tatorg.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter.doFilter(StrutsPrepareAndExecuteFilter.java:99)\n\tatorg.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)\n\tatorg.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)\n\tatorg.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)\n\tatorg.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)\n\tatorg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)\n\tatorg.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)\n\tatorg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)\n\tatorg.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)\n\tatorg.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)\n\tatorg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:423)\n\tatorg.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1079)\n\tatorg.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:625)\n\tatorg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)\n\tatjava.util.concurrent.ThreadPoolExecutor.runWorker(UnknownSource)\n\tatjava.util.concurrent.ThreadPoolExecutor$Worker.run(UnknownSource)\n\tatorg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tatjava.lang.Thread.run(UnknownSource)","host"=>"10.0.0.115:54930","type"=>"log4j-json"}

4. 查询Log4j输出日志

http://10.0.0.5:9200/logstash-2016.05.31/_search?q=*&pretty%27

在elasticsearch中查询到输出的log4j日志。