使用 ELK Stack 集中式日志记录
设置并使用 Elasticsearch、Logstash 和 Kibana，实现集中式日志记录和日志分析。
使用 ELK Stack 集中式日志记录 是 CoddyKit 上的免费 Spring Boot 4 Microservices & REST APIs 课时。 这是第 1 节课，共 3 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Spring Boot 4 Microservices & REST APIs 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Spring Boot 4 Microservices & REST APIs 课程共包含 3 节课。
本课时的部分内容尚未翻译，以英文显示。
Why Centralized Logging?
In a microservices world, applications don't run as one big piece. Instead, they're many small, independent services.
This means logs are scattered across many servers and containers. Finding issues becomes a huge challenge without a central place to view them all.
- Debugging: Hard to trace requests across services.
- Monitoring: Difficult to spot trends or errors.
- Maintenance: Manually checking logs is time-consuming.
Meet the ELK Stack
The ELK Stack is a popular solution for centralized logging. It's a powerful collection of three open-source tools:
- Elasticsearch: Stores and indexes logs.
- Logstash: Processes and transforms logs.
- Kibana: Visualizes and analyzes logs.
Together, they create a robust pipeline for all your application logs.
Elasticsearch: Data Storage
Elasticsearch is a highly scalable search engine. It's built for speed and can handle vast amounts of data, like all your application logs.
- Indexing: Organizes logs for fast searching.
- Scalability: Easily handles growing log volumes.
- Powerful Search: Allows complex queries to find specific events or patterns.
Think of it as the super-efficient database for your logs.
Logstash: Data Pipeline
Logstash is the data processing engine of the ELK stack. It collects logs from various sources, transforms them, and then sends them to Elasticsearch.
It works like a funnel with three main stages:
- Inputs: Where logs are collected from (e.g., files, network, message queues).
- Filters: Where logs are parsed, enriched, or modified (e.g., extract data, remove sensitive info).
- Outputs: Where processed logs are sent (e.g., Elasticsearch).
Kibana: Visualization & Analysis
Kibana is the user interface that sits on top of Elasticsearch. It lets you explore, visualize, and build dashboards from your log data.
With Kibana, you can:
- Search and filter logs in real-time.
- Create interactive charts and graphs.
- Build custom dashboards to monitor application health.
- Identify trends and troubleshoot issues quickly.
Spring Boot Logging Basics
Spring Boot applications use SLF4J as a logging facade and Logback as the default implementation.
By default, Spring Boot logs to the console. These logs include timestamps, log levels (INFO, DEBUG, WARN, ERROR), thread names, and the actual log message.
This console output is a common source for Logstash or other agents to pick up.
Simple Spring Boot Logger
Here's a minimal Spring Boot application that demonstrates basic logging at different levels. Run it and observe the console output.
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
public class LoggingApp {
private static final Logger logger = LoggerFactory.getLogger(LoggingApp.class);
public static void main(String[] args) {
SpringApplication.run(LoggingApp.class, args);
logger.info("Spring Boot LoggingApp started!");
logger.debug("This is a debug message.");
logger.warn("A warning in the app.");
logger.error("An error occurred!");
}
}Getting Logs to ELK
How do logs from your Spring Boot app reach the ELK stack?
A common approach is to use Filebeat. Filebeat is a lightweight shipper that runs on your application servers. It monitors log files or console output and forwards them to Logstash or Elasticsearch.
This makes sure logs are collected reliably without burdening your application.
The ELK Stack Workflow
Let's summarize the typical flow for centralized logging with ELK:
- Your Spring Boot Application generates logs (e.g., to console or a file).
- Filebeat collects these logs from the source.
- Logstash receives logs from Filebeat, processes them (parses, filters).
- Logstash sends processed logs to Elasticsearch for storage and indexing.
- Kibana queries Elasticsearch to visualize and analyze the log data.
ELK Component Roles
Each component in the ELK stack has a distinct and crucial role. Understanding these roles is key to effective logging.
Lesson Summary
We've explored the importance of centralized logging for microservices and introduced the ELK (Elasticsearch, Logstash, Kibana) stack.
- Elasticsearch: Stores and indexes logs for fast searching.
- Logstash: Processes and transforms logs from various sources.
- Kibana: Provides powerful visualization and analysis tools.
- Filebeat: A common agent for collecting logs from applications.
This powerful combination ensures you can effectively monitor and troubleshoot your distributed applications.
常见问题解答
「使用 ELK Stack 集中式日志记录」课时是免费的吗？
是的 — 「使用 ELK Stack 集中式日志记录」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Spring Boot 4 Microservices & REST APIs 课程的其余内容，请升级到 CoddyKit PRO。 Spring Boot 4 Microservices & REST APIs 课程共包含 3 节课。
「使用 ELK Stack 集中式日志记录」这节课中我会学到什么？
设置并使用 Elasticsearch、Logstash 和 Kibana，实现集中式日志记录和日志分析。 你通过在浏览器中直接运行的动手代码来练习 Spring Boot 4 Microservices & REST APIs，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 Spring Boot 4 Microservices & REST APIs 需要有经验吗？
无需任何先前经验。CoddyKit 上的 Spring Boot 4 Microservices & REST APIs 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 1 节课，共 3 节。
「使用 ELK Stack 集中式日志记录」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 Spring Boot 4 Microservices & REST APIs 课中编写并运行代码吗？
能。每节 Spring Boot 4 Microservices & REST APIs 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。