GrayLog 搭建

下载地址

1、新建docker-compose.yml文件

按需修改（例如不耦合mongodb、elasticsearch等）
修改密码需要使用密文：参考官方文档 位置：Graylog / GraylogConfiguring / server.conf / PROPERTIES / GENERAL / root_password_sha2 = <SHA2>

version: '3'
services:
    # MongoDB: https://hub.docker.com/_/mongo/
    mongo:
      image: mongo:4.2
      networks:
        - graylog
    # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/7.10/docker.html
    elasticsearch:
      image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2
      environment:
        - http.host=0.0.0.0
        - transport.host=localhost
        - network.host=0.0.0.0
        - "ES_JAVA_OPTS=-Dlog4j2.formatMsgNoLookups=true -Xms512m -Xmx512m"
      ulimits:
        memlock:
          soft: -1
          hard: -1
      deploy:
        resources:
          limits:
            memory: 1g
      networks:
        - graylog
    # Graylog: https://hub.docker.com/r/graylog/graylog/
    graylog:
      image: graylog/graylog:4.2
      environment:
        # CHANGE ME (must be at least 16 characters)!
        - GRAYLOG_PASSWORD_SECRET=somepasswordpepper
        # Password: admin
        # 加密:Linux执行 echo -n “Enter Password: ” && head -1 </dev/stdin | tr -d ‘\n’ | sha256sum | cut -d” ” -f1
        - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
        - GRAYLOG_HTTP_EXTERNAL_URI=http://127.0.0.1:9000/
        # 非同一台机器部署elasticsearch时，配置elasticsearch命令：
        # - GRAYLOG_ELASTICSEARCH_HOSTS=http://elasticsearch所在服务器IP:端口
        # 配置时区 使用 Asia/Shanghai ，改了没用=>网页重新登录graylog
        - GRAYLOG_ROOT_TIMEZONE=Asia/Shanghai
      entrypoint: /usr/bin/tini -- wait-for-it elasticsearch:9200 --  /docker-entrypoint.sh
      networks:
        - graylog
      restart: always
      depends_on:
        - mongo
        - elasticsearch
      ports:
        # Graylog web interface and REST API
        - 9000:9000
        # Syslog TCP
        - 1514:1514
        # Syslog UDP
        - 1514:1514/udp
        # GELF TCP
        - 12201:12201
        # GELF UDP
        - 12201:12201/udp
networks:
    graylog:
      driver: bridge

2、进入文件目录

在当前目录下执行docker-compose up指令

SpringBoot 集成 GrayLog（未验证安全性）

加入依赖

<dependency>
    <groupId>de.siegmar</groupId>
    <artifactId>logback-gelf</artifactId>
    <version>2.0.0</version>
</dependency>

logback.xml配置文件（需要在resources目录下），增加内容：

<configuration>
    <appender name="GELF_ONLINE" class="de.siegmar.logbackgelf.GelfUdpAppender">
    	<!--搭载graylog的服务器ip-->
        <graylogHost>localhost</graylogHost>
        <graylogPort>12201</graylogPort>
        <encoder class="de.siegmar.logbackgelf.GelfEncoder">
            <staticField>app_name:interface_spring</staticField>
            <staticField>errorcode:%X{errorcode}</staticField>
            <staticField>errstack:%X{errstack}</staticField>
            <staticField>connector-log-id:%X{connector-log-id}</staticField>
            <staticField>delete-user-id:%X{delete-user-id}</staticField>
        </encoder>
    </appender>
    <!--是推送日志级别-->
    <root level="debug">
        <appender-ref ref="GELF_ONLINE"/>
    </root>
</configuration>