CODEWITHSUNDEEP
javalogstashlog4j2
golwig
golwig

Reputation: 139

Adding attributes to Log4j 2 Events

I'd like to add some additional information/attributes like "application" name to my log4j2 Events (for some reason this attribute is not availible in log4j2 anymore..) The Logs are sent over LAN to a Logstash instance.

I've worked out a solution including:

  1. Custom Appender Layout (https://github.com/majikthys/log4j2-logstash-jsonevent-layout): the layout extracts all attributes from the Log4jLogEvent and the additional attributes that can be provided through the log4j2 configuration and produces a JSON String.
  2. Logstash configuration:

    input {
        tcp {
            codec => json_lines { charset => "UTF-8" }
            port => 4560
            type => "log4j2-json"
            mode => "server"    
        }  
    }
    ...

The solution above works but requires the Layout to be built and added/maintained as a jar in every application.

So the question is - are there any better solutions that I've missed out? Ideal would be a solution that wouldn't require adding any new jars/classes and uses of 3rd party software. Something like RewriteAppender but without use of "MapMessage".

Upvotes: 2

Views: 2642

Answers (2)

mp911de
mp911de

Reputation: 18119

You can use logstash over GELF with https://github.com/mp911de/logstash-gelf for your use case. Application name is more related to the client than to a central logstash server. Config looks like:

<Configuration>
    <Appenders>
        <Gelf name="gelf" host="udp:localhost" port="12201" originHost="%host{fqdn}">
            <Field name="timestamp" pattern="%d{dd MMM yyyy HH:mm:ss,SSS}" />
            <Field name="level" pattern="%level" />
            <Field name="simpleClassName" pattern="%C{1}" />

            <Field name="applicationName" literal="MyApplicationName" />

            <!-- This is a field using MDC -->
            <Field name="mdcField2" mdc="mdcField2" /> 
            <DynamicMdcFields regex="mdc.*" />
        </Gelf>
    </Appenders>
    ...
</Configuration>

Upvotes: 1

mmitaru
mmitaru

Reputation: 58

I ended up using a log4j 2 TcpSocketServer to receive remote logs and then forward them locally to logstash over a tcp socket (you could use a file too...).

http://logging.apache.org/log4j/2.x/log4j-core/apidocs/org/apache/logging/log4j/core/net/server/TcpSocketServer.html

I don't think this solution is ideal, but it doesn't require the custom appender.

Upvotes: 0

Related Questions