Log4j直接记录到Elasticsearch服务器 [英] Log4j logging directly to elasticsearch server

问题描述

我对如何将日志条目直接放入elasticsearch(不是logstash)感到有些困惑.到目前为止，我发现了一些附加程序(log4j.appender.SocketAppender，log4j.appender.server等)，它们允许将日志发送到远程主机，还有ConversionPattern可能性，似乎可以使我们将日志转换为弹性友好"格式，但这方法看起来很怪异...还是我会误会?这是将日志发送到elastic的一种方法吗?

I'm a bit confused on how can I put my log entries directly to elasticsearch (not logstash). So far I found a few appenders (log4j.appender.SocketAppender, log4j.appender.server etc.) that allow to send logs to remote host and also ConversionPattern possibility that seems to allow us to convert logs to "elastic-friendly" format, but this approach looks freaky... or do I mistake? Is this the one way to send logs to elastic?

到目前为止，我有这样的配置:

So far I have a such config:

log4j.rootLogger=DEBUG, server
log4j.appender.server=org.apache.log4j.net.SocketAppender
log4j.appender.server.Port=9200
log4j.appender.server.RemoteHost=localhost
log4j.appender.server.ReconnectionDelay=10000
log4j.appender.server.layout.ConversionPattern={"debug_level":"%p","debug_timestamp":"%d{ISO8601}","debug_thread":"%t","debug_file":"%F", "debug_line":"%L","debug_message":"%m"}%n

但是我得到一个错误:

log4j:WARN Detected problem with connection: java.net.SocketException: Broken pipe (Write failed)

我找不到任何有用的示例，所以我无法理解我该怎么做以及如何解决.谢谢.

I can't find any useful example so I can't understand what do I do wrong and how to fix it. Thanks.

推荐答案

我找到了最符合我要求的解决方案.这是 graylog . 由于它是基于elasticsearch构建的，因此用法很熟悉，因此我能够立即切换到它.

I found solution that fits my requirements most. It's a graylog . Since it's build based on elasticsearch the usage is familiar so I was able to switch to it immediately.

要使用它，我添加了此依赖项以及基本的log4j2依赖项:

To use it I added this dependency along with basic log4j2 dependencies:

<dependency>
    <groupId>org.graylog2.log4j2</groupId>
    <artifactId>log4j2-gelf</artifactId>
    <version>1.3.2</version>
</dependency>

并使用log4j2.json配置:

{
  "configuration": {
    "status": "info",
    "name": "LOGGER",
    "packages": "org.graylog2.log4j2",
    "appenders": {
      "GELF": {
        "name": "GELF",
        "server": "log.myapp.com",
        "port": "12201",
        "hostName": "my-awsome-app",
        "JSONLayout": {
          "compact": "false",
          "locationInfo": "true",
          "complete": "true",
          "eventEol": "true",
          "properties": "true",
          "propertiesAsList": "true"
        },
        "ThresholdFilter": {
          "level": "info"
        }
      }
    },
    "loggers": {
      "logger": [
        {
          "name": "io.netty",
          "level": "info",
          "additivity": "false",
          "AppenderRef": {
            "ref": "GELF"
          }
        }        
      ],
      "root": {
        "level": "info",
        "AppenderRef": [
          {
            "ref": "GELF"
          }
        ]
      }
    }
  }
}

这篇关于Log4j直接记录到Elasticsearch服务器的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！