带有LogStash的JSON变体(Log4J) [英] JSON Variants (Log4J) with LogStash

问题描述

我不确定这是

I'm not sure if this is a follow-up or separate question to this one. There is some piece about LogStash that is not clicking. For that, I apologize for a related question. Still, I'm going out of my mind here.

我有一个将日志写入文件的应用程序.每个日志条目都是一个JSON对象.我的.json文件的示例如下所示:

I have an app that writes logs to a file. Each log entry is a JSON object. An example of my .json file looks like the following:

{
  "logger":"com.myApp.ClassName",
  "timestamp":"1456976539634",
  "level":"ERROR",
  "thread":"pool-3-thread-19",
  "message":"Danger. There was an error",
  "throwable":"java.Exception"
},
{
  "logger":"com.myApp.ClassName",
  "timestamp":"1456976539649",
  "level":"ERROR",
  "thread":"pool-3-thread-16",
  "message":"I cannot go on",
  "throwable":"java.Exception"
}

此格式是从Log4J2的JsonLayout创建的格式.我正在尽我最大的努力使日志条目进入LogStash.为了做到这一点，我创建了以下LogStash配置文件:

This format is what's created from Log4J2's JsonLayout. I'm trying my damnedest to get the log entries into LogStash. In an attempt to do this, I've created the following LogStash configuration file:

input {
  file {
    type => "log4j"
    path => "/logs/mylogs.log"
  }
}
output {
  file {
    path => "/logs/out.log"
  }
}

当我打开/logs/out.log时，我看到一团糟.有JSON.但是，我看不到Log4J生成的级别"属性或线程"属性.可以在此处查看记录示例:

When I open /logs/out.log, I see a mess. There's JSON. However, I do not see the "level" property or "thread" property that Log4J generates. An example of a record can be seen here:

{"message":"Danger. There was an error","@version":"1","@timestamp":"2014-04-08T17:20:10.035Z","type":"log4j","host":"ip-myAddress","path":"/logs/mylogs.log"}

有时候，我什至会遇到解析错误.我需要我的属性仍然是属性.我不希望它们挤在消息部分或输出中.我有一种预感，这与编解码器有关.但是，我不确定.我不确定是否应该在logstash输入配置上更改编解码器.或者，如果我应该更改输出配置上的输入.衷心感谢您的帮助，因为我现在迫在眉睫.

Sometimes I even get parse errors. I need my properties to still be properties. I do not want them crammed into the message portion or the output. I have a hunch this has something to do with Codecs. Yet, I'm not sure. I'm not sure if I should change the codec on the logstash input configuration. Or, if I should change the input on the output configuration. I would sincerely appreciate any help as I'm getting desperate at this point.

推荐答案

您可以更改日志格式吗?

Can you change your log format?

将您的日志格式更改为

{ "logger":"com.myApp.ClassName", "timestamp":"1456976539634", "level":"ERROR", "thread":"pool-3-thread-19", "message":"Danger. There was an error",  "throwable":"java.Exception" }
{ "logger":"com.myApp.ClassName", "timestamp":"1456976539649", "level":"ERROR", "thread":"pool-3-thread-16", "message":"I cannot go on", "throwable":"java.Exception" }

每行一个json日志，并且在日志末尾没有，" ，我可以使用下面的配置来解析json消息以对应字段.

One json log per one line and without the "," at the end of the log, I can use the configuration below to parse the json message to correspond field.

input {
    file {
       type => "log4j"
       path => "/logs/mylogs.log"
       codec => json
    }
}

这篇关于带有LogStash的JSON变体(Log4J)的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！