CODEWITHSUNDEEP
javajsonlogbackslf4jlogstash-logback-encoder
Gman
Gman

Reputation: 2453

Format java logs out in JSON to use in ELK Stack

I am trying to out put my logger in JSON format so I can elimate the need to use filters in my ELK Stack. It does seem to work.

Here is what I have

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.json.simple.JSONObject; 

public class MyApp {

   static Logger logger = LoggerFactory.getLogger(MyApp.class);

   @SuppressWarnings("unchecked")
   public static void main(String[] args) {
      // TODO Auto-generated method stub
      JSONObject obj = new JSONObject();
      JSONObject obj2 = new JSONObject();


      obj.put("name","foo");
      obj.put("num",new Integer(100));
      obj.put("balance",new Double(1000.21));
      obj.put("is_vip",new Boolean(true));

      obj2.put("ob2name","bar");
      obj2.put("ob2num",new Integer(200));

      obj.put("names", obj2);


      logger.info("{}", obj);

   }

}

Output to my file.log

{"@timestamp":"2016-07-27T17:51:08.331+01:00","@version":1,"thread_name":"main","logger_name":"MyApp","level":"INFO","level_value":20000,"HOSTNAME":"gman","message":"{\"names\":{\"ob2num\":200,\"ob2name\":\"bar\"},\"balance\":1000.21,\"is_vip\":true,\"num\":100,\"name\":\"foo\"}"}

Output to logstash Console

{
     "@timestamp" => "2016-07-27T16:51:08.331Z",
       "@version" => 1,
    "thread_name" => "main",
    "logger_name" => "MyApp",
          "level" => "INFO",
    "level_value" => 20000,
       "HOSTNAME" => "gman",
        "message" => "{\"names\":{\"ob2num\":200,\"ob2name\":\"bar\"},\"balance\":1000.21,\"is_vip\":true,\"num\":100,\"name\":\"foo\"}",
           "host" => "gman",
           "path" => "C:\\apps\\dots\\logs\\file.log"
}

My Question

The message seem to be out-put as a String how can I out-put it as JSON so Elasticsearch can pick up the individual fields and index them so they can be searchable?

Upvotes: 4

Views: 2123

Answers (2)

ThomasRS
ThomasRS

Reputation: 8287

Alternatively use a Map and do somethink like this:

Map<String, Object> map = new HashMap<>();
map.put("system", "fedora");
logger.info(Markers.appendEntries(map), "Hello world");

for 

{
  "message" : "Hello world",
  "system" : "fedora"
}

(default fields omitted).

Upvotes: 1

Rick Chen
Rick Chen

Reputation: 181

In your Logstash's conf file, add the json filter:

filter {
    json {
        source => message
    }
}

Upvotes: 1

Related Questions