/usr/local/tomcat/conf/logging.properties

%a - Remote IP address.See also %{xxx}a below.
%A - Local IP address
%b - Bytes sent, excluding HTTP headers, or '-' if zero
%B - Bytes sent, excluding HTTP headers
%h - Remote host name (or IP address if enableLookups for the connector is false)
%H - Request protocol
%l - Remote logical username from identd (always returns'-')
%m - Request method (GET, POST, etc.)
%p - Local port on which this request was received.See also %{xxx}p below.
%q - Query string (prepended with a '?' if it exists)
%r - First line of the request (method and request URI)
%s - HTTP status code of the response
%S - User session ID
%t - Date and time, in Common Log Format
%u - Remote user that was authenticated (if any), else '-' (escaped if required)
%U - Requested URL path
%v - Local server name
%D - Time taken to process the request in millis. Note: Inhttpd %D is microseconds. Behaviour will be aligned to httpdin Tomcat 10 onwards.
%T - Time taken to process the request, in seconds. Note: Thisvalue has millisecond resolution whereas in httpd it hassecond resolution. Behaviour will be align to httpdin Tomcat 10 onwards.
%F - Time taken to commit the response, in milliseconds
%I - Current request thread name (can compare later with stacktraces)
%X - Connection status when response is completed: 
    ◦X = Connection aborted before the response completed.
    ◦+ = Connection may be kept alive after the response is sent.
    ◦- = Connection will be closed after the response is sent.

#There is also support to write information incoming or outgoingheaders, cookies, session or request attributes and specialtimestamp formats.It is modeled after the Apache HTTP Server log configurationsyntax. Each of them can be used multiple times with different xxx keys: 
%{xxx}a write remote address (client) (xxx==remote) orconnection peer address (xxx=peer)
%{xxx}i write value of incoming header with name xxx (escaped if required)
%{xxx}o write value of outgoing header with name xxx (escaped if required)
%{xxx}c write value of cookie with name xxx (escaped if required)
%{xxx}r write value of ServletRequest attribute with name xxx (escaped if required)
%{xxx}s write value of HttpSession attribute with name xxx (escaped if required)
%{xxx}p write local (server) port (xxx==local) orremote (client) port (xxx=remote)
%{xxx}t write timestamp at the end of the request formatted using theenhanced SimpleDateFormat pattern xxx

...

#默认记录格式
#vim /apps/tomcat/conf/server.xml
...
pattern="%h %l %u %{Y-M-H:m:s}t "%r" %s %b"
...
#输出格式如下：
10.0.0.102 - - 2021-10-15:36:7 "GET / HTTP/1.1" 200 11156
--------------------------------------------------------------------------------------
#转为ELK需要的json格式，说明：" 在html中表示双引号
vim /apps/tomcat/conf/server.xml
...
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
               prefix="tomcat_access_log" suffix=".log"
               pattern="{&quot;client&quot;:&quot;%h&quot;,  &quot;client user&quot;:&quot;%l&quot;,   &quot;authenticated&quot;:&quot;%u&quot;,   &quot;access time&quot;:&quot;%t&quot;,     &quot;method&quot;:&quot;%r&quot;,   &quot;status&quot;:&quot;%s&quot;,  &quot;send bytes&quot;:&quot;%b&quot;,  &quot;Query?string&quot;:&quot;%q&quot;,  &quot;partner&quot;:&quot;%{Referer}i&quot;,  &quot;Agent version&quot;:&quot;%{User-Agent}i&quot;}"/>
#以上配置文件在135行
...
--------------------------------------------------------------------------------------
#输出格式如下：
{"client":"10.0.0.102",  "client user":"-",   "authenticated":"-",   "access time":"[15/Oct/2021:15:42:25 +0800]",     "method":"GET / HTTP/1.1",   "status":"200",  "send bytes":"11156",  "Query?string":"",  "partner":"-",  "Agent version":"curl/7.68.0"}
--------------------------------------------------------------------------------------
#json转换器显示结果：
{
    "client":"10.0.0.102",
    "client user":"-",
    "authenticated":"-",
    "access time":"[15/Oct/2021:15:42:25 +0800]",
    "method":"GET / HTTP/1.1",
    "status":"200",
    "send bytes":"11156",
    "Query?string":"",
    "partner":"-",
    "Agent version":"curl/7.68.0"
}