Logback.groovy LogstashEncoder altering field names

Question

I have a logback.groovy that sends data to a logstash on the network with some custom fields:

appender("LOGSTASH", LogstashTcpSocketAppender) {
  encoder(LogstashEncoder) {
    customFields = """{ "token": "xxxxx", "environment":"dev", "some_property":"foobar" }"""
  }
  remoteHost = "logstashlistener.host.name"
  port = 5000
}

So far so good. However, I need to cleanup some field names that are not valid for elasticsearch downstream. Based on the LogstashEncoder documentation, this can be achieved like this:

<encoder class="net.logstash.logback.encoder.LogstashEncoder">
  <fieldNames>
    <timestamp>time</timestamp>
    <message>msg</message>
    ...
  </fieldNames>
</encoder>

This seems great but I have to fit this into the logback.groovy notation. I tried as a hashmap, string and more but always end up with Cannot cast object 'xxxx' with class 'xxxx' to class 'net.logstash.logback.fieldnames.LogstashFieldNames'

Answer 1

Try the following. You might also need to add some import for FieldNames and LifeCycle

appender("LOGSTASH", LogstashTcpSocketAppender) {
  encoder(LogstashEncoder) {
    customFields = """{ "token": "xxxxx", "environment":"dev", "some_property":"foobar" }"""

    FieldNames... aFieldNames = new FieldNames()
    aFieldNames.timestamp = "time"
    aFieldNames.message = "msg"
    if(aFieldNames instanceof LifeCycle)
      aFieldNames.start()
    fieldNames = aFieldNames
  }
  remoteHost = "logstashlistener.host.name"
  port = 5000
}

You can use the following helper page on the Logback website to transform your XML configuration into Groovy.

http://logback.qos.ch/translator/asGroovy.html

Answer 2

I had to do something similar, though I was using the LoggingEventCompositeJsonEncoder encoder.

The approach I've had to use is to dig through the logstash-logback-encoder code to work out the real classes involved. Thankfully IntelliJ's decompiler makes this not too painful.

If you look at LogstashEncoder it has a method public void setFieldNames(LogstashFieldNames fieldNames) - so what you need is an instance of LogstashFieldNames

LogstashFieldNames in turn has setters for setTimestamp and the rest, so in groovy your syntax should be:

    encoder(LogstashEncoder) {
        fieldNames(LogstashFieldNames) {
            timestamp = "time"
            message = "msg"
        }
    }