1.FileBeat 配置采集日志目录

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # 日志文件路径
  paths:
    - /var/log/boot-sst/*.log

2.FileBeat 配置日志存入ES

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]

  # Protocol - either `http` (default) or `https`.
  #protocol: "https"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elastic"
  password: "elastic"
  index: "app_log-%{+yyyyMMdd}"
#用日期通配符生成索引
setup.template.enabled: false
setup.ilm.enabled: false

3.启动FileBeat

nohup ./filebeat -e -c filebeat.yml >/dev/null 2>&1 & disown
#disown 不会让终端关闭导致filebeat进程被杀

4.访问ES查看索引

[root@ecs-5534 filebeat7]# curl -u elastic:elastic 'http://127.0.0.1:9200/_cat/indices?v'
health status index                            uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   filebeat-7.6.2-2026.04.16-000001 JQsMTrnzSHuIAG7-UpuStA   1   1      14783            0      2.2mb          2.2mb
green  open   .geoip_databases                 K6wNx2A7SDKtEQqbbJN7aA   1   0         38            0     35.9mb         35.9mb
yellow open   app_log-20260416                 YBWtmmh4RmaOQpFu6vESZA   1   1      15233            0      6.5mb          6.5mb
green  open   .security-7                      gB7D97K4QqKVgboO0AlONQ   1   0          7            0     25.8kb         25.8kb

生成了一个app_log-20260416带日期的索引（ES中索引跟sql数据库的表概念相似）

5.随便写一点定时打印日志java代码

    @Scheduled(cron = "0/5 * * * * ?")
   public  void printDayminin(){
        Date date=new Date();
       SimpleDateFormat dateFormat=new SimpleDateFormat("yyyyMMdd HH:mm");
       String formattedDate=dateFormat.format(date);
       log.info("格式化后的日期: {}", formattedDate);
       log.info("当前时间戳: {}", System.currentTimeMillis());
   }

6.LogBack.xml配置样例

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <!-- 定义日志文件存储路径 -->
    <property name="LOG_PATH" value="/var/log/boot-sst"/>
    <property name="APP_NAME" value="boot-sst-plugin-example"/>
    
    <!-- 控制台输出 -->
    <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
            <charset>UTF-8</charset>
        </encoder>
    </appender>
    
    <!-- 所有日志文件 -->
    <appender name="FILE_ALL" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>${LOG_PATH}/${APP_NAME}.log</file>
        <encoder>
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
            <charset>UTF-8</charset>
        </encoder>
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>${LOG_PATH}/${APP_NAME}.%d{yyyy-MM-dd}.log</fileNamePattern>
            <maxHistory>30</maxHistory>
            <totalSizeCap>10GB</totalSizeCap>
        </rollingPolicy>
    </appender>
    
    <!-- 错误日志文件 -->
    <appender name="FILE_ERROR" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>${LOG_PATH}/${APP_NAME}-error.log</file>
        <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
            <level>ERROR</level>
        </filter>
        <encoder>
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
            <charset>UTF-8</charset>
        </encoder>
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>${LOG_PATH}/${APP_NAME}-error.%d{yyyy-MM-dd}.log</fileNamePattern>
            <maxHistory>30</maxHistory>
            <totalSizeCap>5GB</totalSizeCap>
        </rollingPolicy>
    </appender>
    
    <!-- 插件业务日志文件 -->
    <appender name="FILE_PLUGIN" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>${LOG_PATH}/plugin.log</file>
        <encoder>
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
            <charset>UTF-8</charset>
        </encoder>
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>${LOG_PATH}/plugin.%d{yyyy-MM-dd}.log</fileNamePattern>
            <maxHistory>30</maxHistory>
            <totalSizeCap>5GB</totalSizeCap>
        </rollingPolicy>
    </appender>
    
    <!-- 插件包日志级别设置 -->
    <logger name="com.sst.plugins.example" level="INFO" additivity="false">
        <appender-ref ref="FILE_PLUGIN"/>
        <appender-ref ref="CONSOLE"/>
    </logger>
    
    <!-- 根日志级别 -->
    <root level="INFO">
        <appender-ref ref="CONSOLE"/>
        <appender-ref ref="FILE_ALL"/>
        <appender-ref ref="FILE_ERROR"/>
    </root>
</configuration>

7.请求ES用日期时分格式作为参数

curl -u elastic:elastic -XPOST "http://localhost:9200/app_log-*/_search?pretty" -H "Content-Type:application/json" -d '{
  "query": {
    "match_phrase": {
      "message": "20260416 20:33"
    }
  }
}'

8.实际应用

实际应用中我们可以利用MDC记录应用请求的用户名，token，TraceId等记录到mysql等数据库表中，
根据TraceId或者token等做完参数去ES查询具体的日志数据，
当然日志格式要注意有记录这些东西。这样能比较快速的找到具体的日志