CODEWITHSUNDEEP
amazon-web-serviceslogginggrayloggraylog2gelf
gippo
gippo

Reputation: 39

Unable to get log messages from GELF appender (graylog) - spring

Graylog web page is running as below: enter image description here

enter image description here

Following the documentation for spring boot: graylog-springboot However, nothing shows in the result. Could you Please advise me if you know what im doing wrong.

I have created log4j.xml file as below:

<appender name="graylog" class="org.graylog2.log.GelfAppender">
<param name="graylogHost" value="ec2-x-x-x-x.ap-west-1.compute.amazonaws.com"/>
<param name="originHost" value="ec2-x-x-x-x.eu-west-1.compute.amazonaws.com"/>
<param name="graylogPort" value="12201"/>
<param name="extractStacktrace" value="true"/>
<param name="addExtendedInformation" value="true"/>
<param name="facility" value="log4j"/>
<param name="Threshold" value="INFO"/>
<param name="additionalFields" value="{'environment': 'DEV', 'application': 'GraylogDemoApplication'}"/>

Accordingly opened a port for 9000 and 12201 in the security group.

in the build.gradle:

dependencies { 
  compile 'org.springframework.boot:spring-boot-starter-web'
  compile 'org.springframework.boot:spring-boot-starter-log4j2'
  implementation group: 'org.graylog2', name: 'gelfj', version: '1.1.16'
}


configurations {
all {
    exclude group: 'org.springframework.boot', module: 'spring-boot-starter-logging'
}}

In the application.properties file:

Upvotes: 1

Views: 527

Answers (1)

Wine.Merchant
Wine.Merchant

Reputation: 147

Ensure that the version of Elastic you are running is compatible, currently the highest supported version is 7.10.2. If this is a fresh install it would be worth considering running Opensearch, this would also mean Graylog version installed should be above 4.3. Elastic and Graylog are going through a divorce.

Try the below command, replacing the hostname to test if anything is being ingested.

echo '{ "version": "1.1", "host": "example.org", "short_message": "A short message that helps you identify what is going on", "level": 5, "_some_info": "foo" }\0' | nc -w 1 HOSTNAME 12201

Is there anything in the logs suggesting the message is being dropped?

Where are you sending logs from, does networking/firewalls need to be considered.

Upvotes: 1

Related Questions