log4j 写入elk

要将使用 log4j 记录的日志写入到 ELK Stack 中，可以使用 log4j 的插件 log4j2-elasticsearch。具体步骤如下：

1. 在 log4j2 的配置文件中添加 log4j2-elasticsearch 插件的依赖：

<dependencies>
    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-api</artifactId>
        <version>2.14.1</version>
    </dependency>
    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-core</artifactId>
        <version>2.14.1</version>
    </dependency>
    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-web</artifactId>
        <version>2.14.1</version>
    </dependency>
    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-slf4j-impl</artifactId>
        <version>2.14.1</version>
    </dependency>
    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-elasticsearch</artifactId>
        <version>7.15.0</version>
    </dependency>
</dependencies>

2. 在 log4j2 的配置文件中添加 log4j2-elasticsearch 插件的 appender：

<Appenders>
    <Elasticsearch name="elasticsearch" index="logs" indexDateFormat="yyyy.MM.dd" indexSuffixTimeZone="UTC"
        indexPrefix="log4j2-" indexSuffix="-${sys:es.node.name:unknown}-${sys:es.index.suffix:default}"
        type="json" protocol="http" hostname="localhost" port="9200" ignoreExceptions="false">
        <Property name="es.node.name">${sys:hostname}</Property>
        <Property name="es.index.suffix">${sys:es.index.suffix:default}</Property>
        <Property name="es.index.name">${sys:es.index.name:log4j2}</Property>
        <Property name="es.index.date.separator">-</Property>
        <Property name="es.index.date.pattern">yyyy.MM.dd</Property>
        <Property name="es.index.time.zone">UTC</Property>
        <Property name="es.bulkActions">1000</Property>
        <Property name="es.bulkSize">5MB</Property>
        <Property name="es.flushInterval">1</Property>
        <Property name="es.concurrentRequests">2</Property>
        <Property name="es.flushOnShutdown">true</Property>
        <Property name="es.retryOnConflict">5</Property>
        <Property name="es.maxRetries">3</Property>
        <Property name="es.awaitCloseTimeout">30</Property>
        <Property name="es.idleTimeout">5m</Property>
        <Property name="es.pipeline">log4j2-pipeline</Property>
        <Property name="es.ssl.truststore.path">${sys:javax.net.ssl.trustStore}</Property>
        <Property name="es.ssl.truststore.password">${sys:javax.net.ssl.trustStorePassword}</Property>
        <Property name="es.ssl.keystore.path">${sys:javax.net.ssl.keyStore}</Property>
        <Property name="es.ssl.keystore.password">${sys:javax.net.ssl.keyStorePassword}</Property>
        <Property name="es.ssl.keystore.type">${sys:javax.net.ssl.keyStoreType}</Property>
        <Property name="es.ssl.protocol">${sys:https.protocols}</Property>
        <Property name="es.ssl.enabled">${sys:elasticsearch.ssl.enabled:true}</Property>
        <Property name="es.ssl.verify">${sys:elasticsearch.ssl.verify:true}</Property>
        <Property name="es.headers">Authorization: Basic dXNlcjpwYXNzd29yZA==</Property>
        <Property name="es.ignore_unmapped_fields">true</Property>
        <Property name="es.include_stacktrace">true</Property>
        <Property name="es.hosts">http://localhost:9200</Property>
        <Property name="es.username">username</Property>
        <Property name="es.password">password</Property>
        <Layout type="JsonLayout">
            <KeyValuePair key="time" value="$${date:yyyy-MM-dd'T'HH:mm:ss.SSSZ}"/>
            <KeyValuePair key="logger" value="$${logger: }"/>
            <KeyValuePair key="level" value="$${level: }"/>
            <KeyValuePair key="thread" value="$${thread: }"/>
            <KeyValuePair key="message" value="$${message: }"/>
            <KeyValuePair key="stacktrace" value="$${exception:stacktrace}"/>
        </Layout>
    </Elasticsearch>
</Appenders>

3. 在 log4j2 的配置文件中使用 log4j2-elasticsearch 插件的 appender：

<Root level="info">
    <AppenderRef ref="elasticsearch"/>
</Root>

经过以上三个步骤，就可以将使用 log4j 记录的日志写入到 ELK Stack 中了。