I am trying add custom field into logstash appender in logback-spring.xml like that:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<appender name="stash" class="net.logstash.logback.appender.LogstashSocketAppender">
<host>xx.xx.xx.xx</host>
<port>xxxxx</port>
<encoder class="net.logstash.logback.encoder.LogstashEncoder">
<includeMdcKeyName>myField</includeMdcKeyName>
</encoder>
</appender>
<root level="info">
<appender-ref ref="stash" />
</root>
</configuration>
It gives me error:
Exception in thread "main" java.lang.IllegalStateException: Logback configuration error detected: ERROR in ch.qos.logback.core.joran.spi.Interpreter@34:71 - no applicable action for [encoder], current ElementPath is [[configuration][appender][encoder]]
When I tried console appender and I tried print that field like in sample below it worked.
<layout>
<Pattern>%-4r [%thread] %-5level My Field: [%X{myField:--}] %msg%n</Pattern>
</layout>
Can you tell me what I did wrong with udp appender? Thank you in advice.
You're using an UDP appender, and it does not have an encoder
. You should use TCP Appender (LogstashTcpSocketAppender
instead of LogstashSocketAppender
):
<appender name="stash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
<destination>xx.xx.xx.xx:xxxxx</destination>
<encoder class="net.logstash.logback.encoder.LogstashEncoder">
<includeMdcKeyName>myField</includeMdcKeyName>
</encoder>
</appender>
Take a look a demo project I've created here.
This code (Kotlin):
MDC.put("mdc", "so53558553")
LOG.warn("Warn")
With a logback-spring.xml
like this:
<appender name="logstash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
<destination>localhost:5000</destination>
<encoder class="net.logstash.logback.encoder.LogstashEncoder">
<includeMdcKeyName>mdc</includeMdcKeyName>
</encoder>
</appender>
Produces such records in Logstash:
{
"level_value" => 30000,
"mdc" => "so53558553",
"port" => 35450,
"logger_name" => "by.dev.madhead.playgrounds.so53558553.SpringBootConsoleApplication",
"host" => "172.17.0.1",
"@version" => "1",
"@timestamp" => 2018-12-03T01:16:28.793Z,
"thread_name" => "main",
"message" => "Warn",
"level" => "WARN"
}
As you see, mdc
values are seen by Logstash as a field in the LoggingEvent
.
EDIT
You may not see your field in Kibana due to an ELK misconfiguration. I'm pasting my Logstash pipiline config (/etc/logstash/conf.d/01-input.conf
) just for the reference (it's very basic):
input {
tcp {
port => 5000
codec => json_lines
}
}
output {
elasticsearch {
hosts => [ "localhost:9200" ]
index => "logback-%{+YYYY.MM.dd}"
}
}
Then I've configured logs in Kibana with logback-*
pattern:
And voila:
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With