ELK是一套完整的日志集中处理解决方案，将ElasticSearch、Logstash、Kiabana 三个开源工具配合使用， 完成更强大的用户对日志的查询、排序、统计需求。
搭建环境是基于Docker，Docker Compose。

1. 创建ELK工作目录。

1.1 单机模式：

  1. mkdir -p elk/logstash/library
  2. mkdir -p elk/logstash/sql
  3. mkdir -p elk/elasticsearch/data
  4. mkdir -p elk/elasticsearch/plugins

单机模式ELK目录如下：

  1. .
  2. ├── docker-compose.yml
  3. ├── elasticsearch
  4. │   ├── data
  5. │   └── plugins
  6. └── logstash
  7.     ├── library
  8.     └── sql
  9.     └── logstash.conf

1.2 集群模式：

  1. mkdir -p elk/es01/data
  2. mkdir -p elk/es01/plugins
  3. mkdir -p elk/es02/data
  4. mkdir -p elk/es02/plugins
  5. mkdir -p elk/es03/data
  6. mkdir -p elk/es03/plugins
  7. mkdir -p elk/logstash/library
  8. mkdir -p elk/logstash/sql

集群模式ELK目录如下：

  1. .
  2. ├── docker-compose.yml
  3. ├── es01
  4. │   ├── data
  5. │   └── plugins
  6. ├── es02
  7. │   ├── data
  8. │   └── plugins
  9. ├── es03
  10. │   ├── data
  11. │   └── plugins
  12. └── logstash
  13.     ├── library
  14.     └── sql
  15.     └── logstash.conf

2. 创建logstash的配置文件logstash.conf并放入logstash文件夹。

logstash.conf的参考配置。

  1. input {
  2.   jdbc {
  3.     type => "your_project_order"
  4.     jdbc_driver_library => "/your/path/to/mysql-connector-java-8.0.26.jar"
  5.     jdbc_driver_class => "com.mysql.cj.jdbc.Driver"
  6.     jdbc_connection_string => "jdbc:mysql://{ip}:{port}/{database}?serverTimezone=Asia/Shanghai&characterEncoding=utf8&useSSL=false"
  7.     jdbc_user => "your-username"
  8.     jdbc_password => "your-password"
  9.     schedule => "*/5 * * * *"
  10.     statement_filepath => "/your/path/to/sql/your_project_order.sql"
  11.     use_column_value => true
  12.     tracking_column => "update_time"
  13.     tracking_column_type => "timestamp"
  14.   }
  15.   tcp {
  16.     type => "your_project_system_log"
  17.     mode => "server"
  18.     host => "0.0.0.0"
  19.     port => 4560
  20.     codec => json_lines
  21.   }
  22.   tcp {
  23.     type => "your_project_business_log"
  24.     mode => "server"
  25.     host => "0.0.0.0"
  26.     port => 4561
  27.     codec => json_lines
  28.   }
  29.   kafka {
  30.     type => "your_project_api_log"
  31.     bootstrap_servers => "192.168.3.77:9091,192.168.3.77:9092,192.168.3.77:9093"
  32.     group_id => "logstash-group"
  33.     client_id => "logstash-client"
  34.     auto_offset_reset => "latest"
  35.     topics => ["your-project-log-topic"]
  36.     codec => json { charset => "UTF-8" }
  37.   }
  38. }
  40. output {
  41.   if [type] == "your_project_order" {
  42.     elasticsearch {
  43.       hosts => ["http://192.168.3.77:9200"]
  44.       index => "your_project_order"
  45.       document_id => "%{your_project_order_id}"
  46.     }
  47.   }
  48.   if [type] == "your_project_system_log" {
  49.     elasticsearch {
  50.       hosts => ["http://192.168.3.77:9200"]
  51.       index => "your_project_system_log"
  52.     }
  53.   }
  54.   if [type] == "your_project_business_log" {
  55.     elasticsearch {
  56.       hosts => ["http://192.168.3.77:9200"]
  57.       index => "your_project_business_log"
  58.     }
  59.   }
  60.   if [type] == "your_project_api_log" {
  61.     elasticsearch {
  62.       hosts => ["http://192.168.3.77:9200"]
  63.       index => "your_project_api_log"
  64.     }
  65.   }
  66. }

3. 创建docker-compose.yml文件并放在根目录。

3.1 单机模式

  1. version: '3.8'
  3. networks:
  4.   elastic:
  5.     driver: bridge
  7. services:
  8.   elasticsearch:
  9.     image: elasticsearch:7.14.2
  10.     container_name: elasticsearch
  11.     restart: always
  12.     environment:
  13.       - 'cluster.name=elasticsearch'
  14.       - 'discovery.type=single-node'
  15.       - 'ES_JAVA_OPTS=-Xms512m -Xmx512m'
  16.     volumes:
  17.       - ./elasticsearch/plugins:/usr/share/elasticsearch/plugins
  18.       - ./elasticsearch/data:/usr/share/elasticsearch/data
  19.     networks:
  20.       - elastic
  21.     ports:
  22.       - 9200:9200
  24.   logstash:
  25.     image: logstash:7.14.2
  26.     container_name: logstash
  27.     restart: always
  28.     volumes:
  29.       - ./logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
  30.     networks:
  31.       - elastic
  32.     ports:
  33.       - 4560:4560
  34.       - 4561:4561
  35.     depends_on:
  36.       - elasticsearch
  38.   kibana:
  39.     image: kibana:7.14.2
  40.     container_name: kibana
  41.     restart: always
  42.     environment:
  43.       ELASTICSEARCH_HOSTS: '["http://elasticsearch:9200"]'
  44.     networks:
  45.       - elastic
  46.     ports:
  47.       - 5601:5601
  48.     depends_on:
  49.       - elasticsearch

3.2 集群模式

  1. version: '3.8'
  3. networks:
  4.   elastic:
  5.     driver: bridge
  7. services:
  8.   es01:
  9.     image: elasticsearch:7.14.2
  10.     container_name: es01
  11.     restart: always
  12.     environment:
  13.       - node.name=es01
  14.       - cluster.name=es-docker-cluster
  15.       - discovery.seed_hosts=es02,es03
  16.       - cluster.initial_master_nodes=es01,es02,es03
  17.       - bootstrap.memory_lock=true
  18.       - 'ES_JAVA_OPTS=-Xms1024m -Xmx1024m'
  19.     ulimits:
  20.       memlock:
  21.         soft: -1
  22.         hard: -1
  23.     volumes:
  24.       - ./es01/plugins:/usr/share/elasticsearch/plugins
  25.       - ./es01/data:/usr/share/elasticsearch/data
  26.     ports:
  27.       - 9200:9200
  28.     networks:
  29.       - elastic
  31.   es02:
  32.     image: elasticsearch:7.14.2
  33.     container_name: es02
  34.     restart: always
  35.     environment:
  36.       - node.name=es02
  37.       - cluster.name=es-docker-cluster
  38.       - discovery.seed_hosts=es01,es03
  39.       - cluster.initial_master_nodes=es01,es02,es03
  40.       - bootstrap.memory_lock=true
  41.       - 'ES_JAVA_OPTS=-Xms1024m -Xmx1024m'
  42.     ulimits:
  43.       memlock:
  44.         soft: -1
  45.         hard: -1
  46.     volumes:
  47.       - ./es02/plugins:/usr/share/elasticsearch/plugins
  48.       - ./es02/data:/usr/share/elasticsearch/data
  49.     networks:
  50.       - elastic
  52.   es03:
  53.     image: elasticsearch:7.14.2
  54.     container_name: es03
  55.     restart: always
  56.     environment:
  57.       - node.name=es03
  58.       - cluster.name=es-docker-cluster
  59.       - discovery.seed_hosts=es01,es02
  60.       - cluster.initial_master_nodes=es01,es02,es03
  61.       - bootstrap.memory_lock=true
  62.       - 'ES_JAVA_OPTS=-Xms1024m -Xmx1024m'
  63.     ulimits:
  64.       memlock:
  65.         soft: -1
  66.         hard: -1
  67.     volumes:
  68.       - ./es03/plugins:/usr/share/elasticsearch/plugins
  69.       - ./es03/data:/usr/share/elasticsearch/data
  70.     networks:
  71.       - elastic
  73.   logstash:
  74.     image: logstash:7.14.2
  75.     container_name: logstash-muti
  76.     restart: always
  77.     volumes:
  78.       - ./logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
  79.     networks:
  80.       - elastic
  81.     depends_on:
  82.       - es01
  83.       - es02
  84.       - es03
  85.     ports:
  86.       - 4560:4560
  87.       - 4561:4561
  89.   kibana:
  90.     image: kibana:7.14.2
  91.     container_name: kibana-muti
  92.     restart: always
  93.     environment:
  94.       ELASTICSEARCH_HOSTS: '["http://es01:9200","http://es02:9200","http://es03:9200"]'
  95.     networks:
  96.       - elastic
  97.     depends_on:
  98.       - es01
  99.       - es02
  100.       - es03
  101.     ports:
  102.       - 5601:5601

3.3 注意事项

  1.   - 生产环境不要使用参数 ES_JAVA_OPTS，要手动设置heap size
  2.   - vm.max_map_count至少要设置为262144，设置方式参考[官方文档](https://www.elastic.co/guide/en/elasticsearch/reference/7.16/docker.html#_set_vm_max_map_count_to_at_least_262144)

4. Logstash。

Logstash 是免费且开放的服务器端数据处理管道，能够从多个来源采集数据，转换数据，然后将数据发送到您最喜欢的“存储库”中。Logstash一些注意事项请参考小记：Logstash问题汇总。

4.1 Logstash是通过各种不同的plugins采集数据的。

4.1.1 安装插件命令如下：

  1. # enter logstash container
  2. docker exec -it logstash /bin/bash
  4. # enter bin directory
  5. cd /bin/
  7. # install plugins, choice by yourself
  8. logstash-plugin install logstash-codec-json_lines
  10. # exit logstash container
  11. exit

4.1.2 Logstash插件列表：

  1. logstash-codec-avro
  2. logstash-codec-cef
  3. logstash-codec-collectd
  4. logstash-codec-dots
  5. logstash-codec-edn
  6. logstash-codec-edn_lines
  7. logstash-codec-es_bulk
  8. logstash-codec-fluent
  9. logstash-codec-graphite
  10. logstash-codec-json
  11. logstash-codec-json_lines
  12. logstash-codec-line
  13. logstash-codec-msgpack
  14. logstash-codec-multiline
  15. logstash-codec-netflow
  16. logstash-codec-plain
  17. logstash-codec-rubydebug
  18. logstash-filter-aggregate
  19. logstash-filter-anonymize
  20. logstash-filter-cidr
  21. logstash-filter-clone
  22. logstash-filter-csv
  23. logstash-filter-date
  24. logstash-filter-de_dot
  25. logstash-filter-dissect
  26. logstash-filter-dns
  27. logstash-filter-drop
  28. logstash-filter-elasticsearch
  29. logstash-filter-fingerprint
  30. logstash-filter-geoip
  31. logstash-filter-grok
  32. logstash-filter-http
  33. logstash-filter-json
  34. logstash-filter-kv
  35. logstash-filter-memcached
  36. logstash-filter-metrics
  37. logstash-filter-mutate
  38. logstash-filter-prune
  39. logstash-filter-ruby
  40. logstash-filter-sleep
  41. logstash-filter-split
  42. logstash-filter-syslog_pri
  43. logstash-filter-throttle
  44. logstash-filter-translate
  45. logstash-filter-truncate
  46. logstash-filter-urldecode
  47. logstash-filter-useragent
  48. logstash-filter-uuid
  49. logstash-filter-xml
  50. logstash-input-azure_event_hubs
  51. logstash-input-beats
  52. └── logstash-input-elastic_agent (alias)
  53. logstash-input-couchdb_changes
  54. logstash-input-dead_letter_queue
  55. logstash-input-elasticsearch
  56. logstash-input-exec
  57. logstash-input-file
  58. logstash-input-ganglia
  59. logstash-input-gelf
  60. logstash-input-generator
  61. logstash-input-graphite
  62. logstash-input-heartbeat
  63. logstash-input-http
  64. logstash-input-http_poller
  65. logstash-input-imap
  66. logstash-input-jms
  67. logstash-input-pipe
  68. logstash-input-redis
  69. logstash-input-s3
  70. logstash-input-snmp
  71. logstash-input-snmptrap
  72. logstash-input-sqs
  73. logstash-input-stdin
  74. logstash-input-syslog
  75. logstash-input-tcp
  76. logstash-input-twitter
  77. logstash-input-udp
  78. logstash-input-unix
  79. logstash-integration-elastic_enterprise_search
  80.  ├── logstash-output-elastic_app_search
  81.  └──  logstash-output-elastic_workplace_search
  82. logstash-integration-jdbc
  83.  ├── logstash-input-jdbc
  84.  ├── logstash-filter-jdbc_streaming
  85.  └── logstash-filter-jdbc_static
  86. logstash-integration-kafka
  87.  ├── logstash-input-kafka
  88.  └── logstash-output-kafka
  89. logstash-integration-rabbitmq
  90.  ├── logstash-input-rabbitmq
  91.  └── logstash-output-rabbitmq
  92. logstash-output-cloudwatch
  93. logstash-output-csv
  94. logstash-output-elasticsearch
  95. logstash-output-email
  96. logstash-output-file
  97. logstash-output-graphite
  98. logstash-output-http
  99. logstash-output-lumberjack
  100. logstash-output-nagios
  101. logstash-output-null
  102. logstash-output-pipe
  103. logstash-output-redis
  104. logstash-output-s3
  105. logstash-output-sns
  106. logstash-output-sqs
  107. logstash-output-stdout
  108. logstash-output-tcp
  109. logstash-output-udp
  110. logstash-output-webhdfs
  111. logstash-patterns-core

4.2 使用-h参数，解锁更多使用方式。

命令如下：

  1. # 查询帮助，获取更多命令行
  2. logstash-plugin -h

image.png

5. 以上准备工作都做好后，开始实操。

5.1 启动ELK。

  1. docker-compose up

5.2 检查elasticsearch状态。

打开浏览器并访问http://192.168.3.77:9200/，返回下方JSON，表示启动成功。

  1. {
  2.   "name" : "ea7ce77db80e",
  3.   "cluster_name" : "elasticsearch",
  4.   "cluster_uuid" : "jeJqTZyyS9OC4RgM9sV3ww",
  5.   "version" : {
  6.     "number" : "7.14.2",
  7.     "build_flavor" : "default",
  8.     "build_type" : "docker",
  9.     "build_hash" : "6bc13727ce758c0e943c3c21653b3da82f627f75",
  10.     "build_date" : "2021-09-15T10:18:09.722761972Z",
  11.     "build_snapshot" : false,
  12.     "lucene_version" : "8.9.0",
  13.     "minimum_wire_compatibility_version" : "6.8.0",
  14.     "minimum_index_compatibility_version" : "6.0.0-beta1"
  15.   },
  16.   "tagline" : "You Know, for Search"
  17. }

5.3 检查kibana状态。

打开浏览器并访问 http://192.168.3.77:5601/
image.png

6. 配置Kibana。

6.1 查看索引

进入最下方菜单Stack Management
image.png

Indices列表中是已创建的索引
image.png

6.2 创建索引查询规则

进入菜单Index Patterns，创建索引规则
image.png

6.3 按索引规则查询日志

进入菜单Discover，查看日志
image.png

选择已创建好的索引规则查看
image.png

7.Spring项目集成。

7.1 log4j2

7.1.1 pom.xml 依赖引用

  1. <log4j.version>1.2.17</log4j.version>
  2. <disruptor.version>3.4.4</disruptor.version>
  4. <dependency>
  5.   <groupId>org.springframework.boot</groupId>
  6.   <artifactId>spring-boot-starter-log4j2</artifactId>
  7. </dependency>
  8. <dependency>
  9.   <groupId>log4j</groupId>
  10.   <artifactId>log4j</artifactId>
  11.   <version>${log4j.version}</version>
  12. </dependency>
  13. <dependency>
  14.   <groupId>com.lmax</groupId>
  15.   <artifactId>disruptor</artifactId>
  16.   <version>${disruptor.version}</version>
  17. </dependency>

7.1.2 log4j.xml

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <Configuration status="DEBUG" monitorInterval="1800">
  3.     <Properties>
  4.         <Property name="FILE_PATH">logs</Property>
  5.         <Property name="FILE_NAME">your-project-name</Property>
  6.         <property name="LOG_PATTERN" value="%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] [%p] [%c:%L] -&#45;&#45; %m%n"/>
  7.         <Property name="LOGSTASH_HOST" value="192.168.3.77"></Property>
  8.         <Property name="LOGSTASH_PORT" value="4560"></Property>
  9.     </Properties>
  11.     <Appenders>
  12.         <Console name="Console" target="SYSTEM_OUT">
  13.             <PatternLayout pattern="%date{yyyy-MM-dd HH:mm:ss.SSS} [%file] [%thread] %n%level : %msg%n"/>
  14.         </Console>
  15.         <RollingRandomAccessFile name="HourLogFile" fileName="${FILE_PATH}/${FILE_NAME}-hour.log"
  16.                                  filePattern="${FILE_PATH}/${FILE_NAME}-hour.%d{yyy-MM-dd HH}.log">
  17.             <PatternLayout pattern="${LOG_PATTERN}"/>
  18.             <Policies>
  19.                 <TimeBasedTriggeringPolicy interval="1" modulate="true"/>
  20.             </Policies>
  21.         </RollingRandomAccessFile>
  22.         <Socket name="LOGSTASH" host="${LOGSTASH_HOST}" port="${LOGSTASH_PORT}" protocol="TCP">
  23.             <PatternLayout pattern="${LOG_PATTERN}"/>
  24.             <JsonLayout properties="true"/>
  25.         </Socket>
  26.     </Appenders>
  28.     <Loggers>
  29.         <AsyncLogger name="com.alibaba.druid" level="DEBUG" additivity="false">
  30.             <AppenderRef ref="Console"/>
  31.             <AppenderRef ref="HourLogFile"/>
  32.             <AppenderRef ref="LOGSTASH"/>
  33.         </AsyncLogger>
  34.         <AsyncLogger name="org.springframework" level="DEBUG" additivity="false">
  35.             <AppenderRef ref="Console"/>
  36.             <AppenderRef ref="HourLogFile"/>
  37.             <AppenderRef ref="LOGSTASH"/>
  38.         </AsyncLogger>
  39.         <AsyncLogger name="org.apache.ibatis" level="DEBUG" additivity="false">
  40.             <AppenderRef ref="Console"/>
  41.             <AppenderRef ref="HourLogFile"/>
  42.             <AppenderRef ref="LOGSTASH"/>
  43.         </AsyncLogger>
  45.         <Root level="DEBUG">
  46.             <AppenderRef ref="Console"/>
  47.             <AppenderRef ref="HourLogFile"/>
  48.             <AppenderRef ref="LOGSTASH"/>
  49.         </Root>
  50.     </Loggers>
  51. </Configuration>

7.2 logback

7.2.1 pom.xml 依赖引用

  1. <logstash-logback-encoder.version>5.3</logstash-logback-encoder.version>
  3. <dependency>
  4.   <groupId>net.logstash.logback</groupId>
  5.   <artifactId>logstash-logback-encoder</artifactId>
  6.   <version>${logstash-logback-encoder.version}</version>
  7. </dependency>

7.2.2 logback-spring.xml

  1. <configuration debug="false" scan="false">
  2.   <property name="LOGSTASH_DESTINATION" value="192.168.3.77:4561"/>
  4.   <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
  5.     <destination>${LOGSTASH_DESTINATION}</destination>
  6.     <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder"/>
  7.   </appender>
  9.   <root level="DEBUG">
  10.       <appender-ref ref="LOGSTASH"/>
  11.   </root>
  12. </configuration>

7.3 kafka

7.3.1 pom.xml 依赖引用

  1. <kafka.version>2.4.1</kafka.version>
  2. <jackson.version>2.12.5</jackson.version>
  4. <dependency>
  5.   <groupId>org.springframework.kafka</groupId>
  6.   <artifactId>spring-kafka</artifactId>
  7.   <exclusions>
  8.     <exclusion>
  9.       <artifactId>kafka-clients</artifactId>
  10.       <groupId>org.apache.kafka</groupId>
  11.     </exclusion>
  12.   </exclusions>
  13. </dependency>
  14. <dependency>
  15.   <groupId>org.apache.kafka</groupId>
  16.   <artifactId>kafka-clients</artifactId>
  17.   <version>${kafka.version}</version>
  18. </dependency>
  20. <dependency>
  21.   <groupId>com.fasterxml.jackson.core</groupId>
  22.   <artifactId>jackson-databind</artifactId>
  23.   <version>${jackson.version}</version>
  24. </dependency>

7.3.2 application.properties

  1. # kafka
  2. spring.kafka.bootstrap-servers=192.168.3.77:9091,192.168.3.77:9092,192.168.3.77:9093
  3. ## 生产者配置
  4. ### kafka自带key序列化工具
  5. spring.kafka.producer.key-serializer=org.apache.kafka.common.serialization.StringSerializer
  6. ### 自定义kafka value序列化工具
  7. spring.kafka.producer.value-serializer=com.your.project.kafka.KafkaJsonSerializer

7.3.3 SpringBootApplication 可选

  1. @SpringBootApplication
  2. public class YourProjectApplication {
  4.   public static void main(String[] args) {
  5.     SpringApplication springApplication = new SpringApplication(YourProjectApplication.class);
  6.     springApplication.run(args);
  7.   }
  9.   // 如果没有创建好的Topic，就初始化1个
  10.   @Bean
  11.   public NewTopic topic() {
  12.     return TopicBuilder.name("your-project-log-topic").partitions(10).replicas(1).build();
  13.   }
  14. }

7.3.4 KafkaTemplate

  1. import org.springframework.kafka.core.KafkaTemplate;
  2. import org.springframework.kafka.support.SendResult;
  3. import org.springframework.util.concurrent.ListenableFuture;
  5. @Autowired private KafkaTemplate kafkaTemplate;
  7. YourProjectLog yourProjectLog = new YourProjectLog();
  8. ListenableFuture<SendResult> listenableFuture = kafkaTemplate.send("your-project-log-topic", yourProjectLog);

7.4 Elasticsearch High Level REST Client

7.4.1 pom.xml 依赖引用

  1. <spring-data-elasticsearch.version>4.3.0</spring-data-elasticsearch.version>
  2. <jackson.version>2.12.5</jackson.version>
  3. <elasticsearch.version>7.15.2</elasticsearch.version>
  5. <dependency>
  6.   <groupId>co.elastic.clients</groupId>
  7.   <artifactId>elasticsearch-java</artifactId>
  8.   <version>${elasticsearch.version}</version>
  9. </dependency>
  10. <dependency>
  11.   <groupId>org.springframework.data</groupId>
  12.   <artifactId>spring-data-elasticsearch</artifactId>
  13.   <version>${spring-data-elasticsearch.version}</version>
  14. </dependency>
  15. <dependency>
  16.   <groupId>com.fasterxml.jackson.core</groupId>
  17.   <artifactId>jackson-databind</artifactId>
  18.   <version>${jackson.version}</version>
  19. </dependency>

7.4.2 Spring代理RestHighLevelClient

  1. import org.elasticsearch.client.RestHighLevelClient;
  2. import org.springframework.context.annotation.Bean;
  3. import org.springframework.context.annotation.Configuration;
  4. import org.springframework.data.elasticsearch.client.ClientConfiguration;
  5. import org.springframework.data.elasticsearch.client.RestClients;
  6. import org.springframework.data.elasticsearch.config.AbstractElasticsearchConfiguration;
  8. @Configuration
  9. public class EsRestClientConfig extends AbstractElasticsearchConfiguration {
  11.   @Override
  12.   @Bean
  13.   public RestHighLevelClient elasticsearchClient() {
  14.     final ClientConfiguration clientConfiguration =
  15.         ClientConfiguration.builder().connectedTo("IP:PORT").build();
  16.     return RestClients.create(clientConfiguration).rest();
  17.   }
  18. }

7.4.3 RestHighLevelClient

  1. @Autowired private RestHighLevelClient restHighLevelClient;
  3. SearchRequest searchRequest = new SearchRequest(EsIndex.SKL_ADMIN_OPT_LOG_INDEX);
  4. SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
  5. BoolQueryBuilder boolQueryBuilder = QueryBuilders.boolQuery()
  6.             .should(QueryBuilders.matchQuery("methodNo", "login_v1"))
  7.             .should(QueryBuilders.matchQuery("description", "登录"));
  9. searchSourceBuilder.query(boolQueryBuilder).from(0).size(10).sort("requestTime", SortOrder.DESC);
  10. searchRequest.source(searchSourceBuilder);
  12. SearchResponse searchResponse = restHighLevelClient.search(searchRequest, RequestOptions.DEFAULT);

8.附录。

8.1 Elasticsearch 集群方案。

8.2 logstash-plugins-inputs-kafka文档。

8.3 Elastic Stack and Product Documentation。

8.4 Beats。

8.5 Spring integrate Elasticsearch High Level REST Client。

8.6 Java High Level REST Client QueryBuilders。

8.7 High Level REST Client JavaDoc。

8.8 Rest APIs Doc。

8.9 dejavu 可视化UI