CODEWITHSUNDEEP
logstash
Viorel Florian
Viorel Florian

Reputation: 581

logstash not working with log4j via SocketAppender

I have been trying (and failing) to get logstash working with log4j SocketAppender.

Here is my log4j.properties:

log4j.appender.tcp=org.apache.log4j.net.SocketAppender
log4j.appender.tcp.Port=4560
log4j.appender.tcp.RemoteHost=localhost
log4j.appender.tcp.ReconnectionDelay=10000
log4j.appender.tcp.Application=playground

logstash.conf

input {
  log4j {
  }
}
output {
  stdout {}
}

I have set logstash logging level to TRACE and sent a log message to it. Afterward I found the following lines in the console log of logstash:

11:44:35.778 [Ruby-0-Thread-21: c:/_work/issues/log4j_socketappender/logstash-5.0.1/vendor/bundle/jruby/1.9/gems/logstash-input-log4j-3.0.3-java/lib/logstash/inputs/log4j.rb:155] DEBUG logstash.inputs.log4j - Accepted connection {:client=>"127.0.0.1:61823", :server=>"0.0.0.0:4560"}
11:44:35.795 [Ruby-0-Thread-21: c:/_work/issues/log4j_socketappender/logstash-5.0.1/vendor/bundle/jruby/1.9/gems/logstash-input-log4j-3.0.3-java/lib/logstash/inputs/log4j.rb:155] DEBUG logstash.inputs.log4j - Closing connection {:client=>"127.0.0.1:61823", :exception=>#<IOError: org.apache.log4j.spi.LoggingEvent; class invalid for deserialization>}

Any help is much appreciated.

Upvotes: 0

Views: 1227

Answers (1)

Ziming Chen
Ziming Chen

Reputation: 21

It's a bug. There is a workaround:

Locate file logstash-core/lib/jars.rb in the Logstash installation directory, comment out the below line:

require_jar('org.apache.logging.log4j', 'log4j-1.2-api', '2.6.2')

Discussed in here: GitHub Issue

Upvotes: 2

Related Questions