Master Distributed Tracing in Spring Cloud: Sleuth, Zipkin & ELK Step‑by‑Step

In a microservice architecture each service may run on different servers, so a distributed logging solution is required. Spring Cloud Sleuth provides tracing via logs, and with ELK (Elasticsearch, Logstash, Kibana) you can collect and visualize these logs.

Step 1: Sleuth Management Service

Add the following dependencies to a dedicated project:

<dependency>
  <groupId>io.zipkin.java</groupId>
  <artifactId>zipkin-autoconfigure-ui</artifactId>
  <scope>runtime</scope>
</dependency>

<dependency>
  <groupId>io.zipkin.java</groupId>
  <artifactId>zipkin-server</artifactId>
</dependency>

Configure the Eureka server address:

eureka:
  client:
    serviceUrl:
      defaultZone: http://localhost:1111/eureka/

Add the discovery and Zipkin annotations to the Spring Boot main class:

package com.wlf.demo;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.cloud.client.discovery.EnableDiscoveryClient;
import zipkin.server.EnableZipkinServer;

@EnableDiscoveryClient
@EnableZipkinServer
@SpringBootApplication
public class Application {
    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

After starting the service you can access the Zipkin UI.

Step 2: Microservice Side

Add Sleuth dependencies to each microservice:

<dependency>
  <groupId>org.springframework.cloud</groupId>
  <artifactId>spring-cloud-starter-sleuth</artifactId>
</dependency>

<dependency>
  <groupId>org.springframework.cloud</groupId>
  <artifactId>spring-cloud-sleuth-zipkin</artifactId>
</dependency>

Configure Sleuth and Zipkin:

spring:
  sleuth:
    sampler:
      percentage: 1
  zipkin:
    base-url: http://localhost:9411

The spring.sleuth.sampler.percentage parameter controls the proportion of requests traced (1 means 100% for development). The spring.zipkin.base-url points to the Zipkin management service.

Start the Eureka server, gateway, required microservices, and the Sleuth service, then invoke any microservice. You will see trace logs in Kibana and a dependency graph showing calls such as myservice-consumer-feign → myservice-provider.

ELK Setup

Install Elasticsearch, Kibana and Logstash (the article assumes you already know how). Create a Logstash configuration file (e.g., logstash.conf) with the following content:

output {
  input {
    tcp {
      port => 4560
      codec => json_lines
    }
  }

  output {
    elasticsearch {
      hosts => ["192.168.160.66:9200","192.168.160.88:9200","192.168.160.166:9200"]
      index => "applog"
    }
  }
}

Start Elasticsearch, Kibana, and Logstash, then create the applog index in Kibana and configure the index pattern.

Logback Configuration

Both Spring Cloud and Logstash support Logback, so configure logback-spring.xml for each microservice. The file must be loaded before application.yml, and it should reference the Spring application name via spring.application.name placed in bootstrap.yml. Example configuration:

<?xml version="1.0" encoding="UTF-8"?>
<configuration scan="true" scanPeriod="10 seconds">
  <springProperty scope="context" name="springAppName" source="spring.application.name"/>
  <property name="CONSOLE_LOG_PATTERN" value="%date [%thread] %-5level %logger{36} - %msg%n"/>
  <appender name="stdout" class="ch.qos.logback.core.ConsoleAppender">
    <withJansi>true</withJansi>
    <encoder>
      <pattern>${CONSOLE_LOG_PATTERN}</pattern>
      <charset>utf8</charset>
    </encoder>
  </appender>

  <appender name="logstash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
    <destination>192.168.160.66:4560</destination>
    <encoder class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
      <providers>
        <timestamp>
          <timeZone>UTC</timeZone>
        </timestamp>
        <pattern>
          <pattern>{
            "severity":"%level",
            "service":"${springAppName:-}",
            "trace":"%X{X-B3-TraceId:-}",
            "span":"%X{X-B3-SpanId:-}",
            "exportable":"%X{X-Span-Export:-}",
            "pid":"${PID:-}",
            "thread":"%thread",
            "class":"%logger{40}",
            "rest":"%message"
          }</pattern>
        </pattern>
      </providers>
    </encoder>
  </appender>

  <appender name="dailyRollingFileAppender" class="ch.qos.logback.core.rolling.RollingFileAppender">
    <File>main.log</File>
    <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
      <FileNamePattern>main.%d{yyyy-MM-dd}.log</FileNamePattern>
      <maxHistory>30</maxHistory>
    </rollingPolicy>
    <encoder>
      <Pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{35} - %msg %n</Pattern>
    </encoder>
    <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
      <level>DEBUG</level>
    </filter>
  </appender>

  <springProfile name="!production">
    <logger name="com.myfee" level="DEBUG"/>
    <logger name="org.springframework.web" level="INFO"/>
    <root level="info">
      <appender-ref ref="stdout"/>
      <appender-ref ref="dailyRollingFileAppender"/>
      <appender-ref ref="logstash"/>
    </root>
  </springProfile>

  <springProfile name="production">
    <logger name="com.myfee" level="DEBUG"/>
    <logger name="org.springframework.web" level="INFO"/>
    <root level="info">
      <appender-ref ref="stdout"/>
      <appender-ref ref="dailyRollingFileAppender"/>
      <appender-ref ref="logstash"/>
    </root>
  </springProfile>
</configuration>

The log message is stored in the rest field. After completing the setup, all logs from every server and microservice are searchable in Elasticsearch, and you can trace request flows via Zipkin and Kibana.