Logstash Integrated log4j

1. Configure Log4j.properties

Log4j.rootlogger=info,debug,logstashlog4j.appender.logstash= org.apache.log4j.net.socketappenderlog4j.appender.logstash.port=4560log4j.appender.logstash.remotehost= 10.0.0.5log4j.appender.logstash.reconnetiondelay=60000log4j.appender.logstash.locationinfo=true

2. Modify the Logstash Input component (favblog-log4j.conf) to output the log to Elasticsearch

input{log4j{host = "10.0.0.5" mode = "Server" type = "Log4j-json" port = 4560}}output{S tdout{codec = Rubydebug} elasticsearch {hosts = ["10.0.0.5:9200"]}}

3. Start Logstash

[[email protected] bin]# ./logstash -f favblog-log4j.confsettings: default  pipeline workers: 4log4j:warn no appenders could be found for  logger  (Org.apache.http.client.protocol.RequestAuthCache). log4j:warn please initialize the  log4j system properly.log4j:warn see http://logging.apache.org/log4j/1.2/faq.html# Noconfig for more info. pipeline main started{         "Message"  =>  "* * * hello test! ",       " @version "  =>  "1",      "@timestamp"  =>  "2016-05-31t07:24:34.989z",        "Timestamp"  => 1464679190253,             "path"  =>  "com.favccxx.favblog.platform.interceptOr. Favinterceptor ",       " priority  =>  "INFO",      "Logger_name"  =>  "Com.favccxx.favblog.platform.interceptor.FavInterceptor",           "Thread"  =>  "Http-bio-8080-exec-2",            "Class"  =>  " Com.favccxx.favblog.platform.interceptor.FavInterceptor ",             "File"  =>  "appauthorityinterceptor.java:65",           "method"  =>  "intercept",             "Host"  =>  "10.0.0.115:54930",             "type"  =>  "Log4j-json"}{         " Message " => " ** ERRORINVOKEKEY:[MBGL-S]QEMI2GBHHC ",        "@version"  =>  "1",      "@timestamp"  =>  "2016-05-31t07:24:35.000z",       "timestamp"  =>  1464679190264,            "Path"  =>  " Com.favccxx.favblog.platform.interceptor.FavInterceptor ",       " priority "  =>  "ERROR",     "Logger_name"  =>  " Com.favccxx.favblog.platform.interceptor.FavInterceptor ",           "Thread"  =>  "Http-bio-8080-exec-2",            "Class"  =>  "Com.favccxx.favblog.platform.interceptor.FavInterceptor",             "File"  =>  "appauthorityinterceptor.java:140",           "Method"  =>  "Intercept",            "host"  =>   "10.0.0.115:54930",            "type"  =>   "Log4j-json"}{         "message"  =>  "exception  Occurred during processing request: cannot create a session after  the response has been committed ",       " @version " => " 1 ",     " @timestamp " => " 2016-05-31t07:24:35.023z ",        "Timestamp"  => 1464679190280,             "Path"  =>  " Org.apache.struts2.dispatcher.DefaultDispatcherErrorHandler ",       " Priority " => " ERROR ",    " Logger_name " =>  "Org.apache.struts2.dispatcher.DefaultDispatcherErrorHandler",           "Thread"  =>  "Http-bio-8080-exec-2",            "Class"  =>  "Com.opensymphony.xwork2.util.logging.commons.CommonsLogger",             "File"  =>  "commonslogger.java:42",           "Method"  =>  "error",      "Stack_trace"  =>  "java.lang.illegalstateexception: cannot create a  session after the response has been committed\n\tat  Org.apache.catalina.connector.Request.doGetSession (request.java:3013) \n\tat  Org.apache.catalina.connector.Request.getSession (request.java:2385) \n\tat  Org.apache.catalina.connector.RequestFacade.getSession (requestfacade.java:897) \n\tat javax.servlet.http.hTtpservletrequestwrapper.getsession (httpservletrequestwrapper.java:229) \n\tat  Org.apache.struts2.dispatcher.SessionMap.put (sessionmap.java:182) \n\tat  Org.apache.struts2.interceptor.MessageStoreInterceptor.after (messagestoreinterceptor.java:297) \n\tat  Org.apache.struts2.interceptor.MessageStoreInterceptor.intercept (messagestoreinterceptor.java:198) \n\tat  Com.opensymphony.xwork2.DefaultActionInvocation.invoke (defaultactioninvocation.java:244) \n\tat  Org.apache.struts2.impl.StrutsActionProxy.execute (strutsactionproxy.java:54) \n\tat  Org.apache.struts2.dispatcher.Dispatcher.serviceAction (dispatcher.java:564) \n\tat  Org.apache.struts2.dispatcher.ng.ExecuteOperations.executeAction (executeoperations.java:81) \n\tat  Org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter.doFilter ( strutsprepareandexecutefilter.java:99) \n\tat  Org.apache.catalina.core.ApplicationFilterChain.internalDoFilter (applicationfilterchain.java:241) \n\tat  Org.apacHe.catalina.core.ApplicationFilterChain.doFilter (applicationfilterchain.java:208) \n\tat  Org.apache.catalina.core.StandardWrapperValve.invoke (standardwrappervalve.java:220) \n\tat  Org.apache.catalina.core.StandardContextValve.invoke (standardcontextvalve.java:122) \n\tat  Org.apache.catalina.authenticator.AuthenticatorBase.invoke (authenticatorbase.java:505) \n\tat  Org.apache.catalina.core.StandardHostValve.invoke (standardhostvalve.java:169) \n\tat  Org.apache.catalina.valves.ErrorReportValve.invoke (errorreportvalve.java:103) \n\tat  Org.apache.catalina.valves.AccessLogValve.invoke (accesslogvalve.java:956) \n\tat  Org.apache.catalina.core.StandardEngineValve.invoke (standardenginevalve.java:116) \n\tat  Org.apache.catalina.connector.CoyoteAdapter.service (coyoteadapter.java:423) \n\tat  Org.apache.coyote.http11.AbstractHttp11Processor.process (abstracthttp11processor.java:1079) \n\tat  Org.apache.coyote.abstractprotocol$abstractconnectionhandler.process (Abstractprotocol.java:625) \n\tat org.apache.tomcat.util.net.jioendpoint$socketprocessor.run (JIoEndpoint.java : \n\tat java.util.concurrent.threadpoolexecutor.runworker (Unknown source) \n\tat  Java.util.concurrent.threadpoolexecutor$worker.run (Unknown source) \n\tat  Org.apache.tomcat.util.threads.taskthread$wrappingrunnable.run (taskthread.java:61) \n\tat  Java.lang.Thread.run (Unknown source) ",           " Host " => " 10.0.0.115:54930 ",           " Type " => " Log4j-json "}

4. Querying the log4j output log

Http://10.0.0.5:9200/logstash-2016.05.31/_search?q=*&pretty%27

The log4j log of the output is queried in Elasticsearch.

This article is from the "This person's IT World" blog, be sure to keep this source http://favccxx.blog.51cto.com/2890523/1827811

Logstash Integrated log4j