input{

        tcp {

                mode => "server"

                host => "0.0.0.0"

                port => 4567

                codec => json_lines

        }

}

output{

        elasticsearch{

                hosts=>["127.0.0.1:9200"]

                index => "user-%{+YYYY.MM.dd}"

                }

        stdout{codec => rubydebug}

}

<dependency>

            <groupId>net.logstash.logback</groupId>

            <artifactId>logstash-logback-encoder</artifactId>

            <version>5.1</version>

 </dependency>

<?xml version="1.0" encoding="UTF-8"?>

<configuration>

    <include resource="org/springframework/boot/logging/logback/base.xml" />

    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">

        <destination>172.31.226.157:4567</destination> //logstash ip和暴露的端口，我目前理解就是通过这个地址把日志发送过去

        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder" />

    </appender>

    <root level="INFO">

        <appender-ref ref="LOGSTASH" />

        <appender-ref ref="CONSOLE" />

    </root>

</configuration>

logging:

  config: classpath:logback-spring.xml