How to use log4jplus with logstash?

I'm new to logstash.
I'm trying to send logs of my C++ application to logstash using log4cplus library. I need to send some json data from my application to logstash. To start with I have written some piece of code that sends a string to logstash.

Below is my logstash configurations

input {
tcp {
port => 5044
}
}

filter{
}

output {
stdout {
codec => rubydebug
}
}

Below is my code that sends data to logstash and log4cplus configurations.

code :

PropertyConfigurator config(configFile);
config.configure();
std::string msg = "test msg";
Logger root = Logger::getRoot();
LOG4CPLUS_INFO(root,msg);

log4cplus conf :

log4cplus.rootLogger=INFO, SA
log4cplus.appender.SA=log4cplus::SocketAppender
log4cplus.appender.SA.port=5044
log4cplus.appender.SA.host=127.0.0.1
log4cplus.appender.SA.serverName=MyServer
log4cplus.appender.SA.layout=log4cplus::PatternLayout
log4cplus.appender.SA.layout.ConversionPattern=%m%n

I was expecting "test message" to be printed on logstash console. But i was receiving some garbage data as shown below.

{
"@version" => "1",
"host" => "localhost",
"message" => "\u0000\u0000\u0000q\u0003\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004root\u0000\u0000N \u0000\u0000\u0000\u0000\u0000\u0000\u0000\btest msg\u0000\u0000\u0000\u000F140382836238144Z{\u0014N\u0000\u0004\u0003\xC0\u0000\u0000\u0000\u0013../src/property.cpp\u0000\u0000\u00002\u0000\u0000\u0000\u0015int main(int, char**)",
"@timestamp" => 2018-02-07T14:59:26.284Z,
"port" => 47148
}

Can i do something in logstash configurations to get actual message ?
Also is it possible to use log4cplus with logstash for logging ?

Log4cplus's SocketAppender apparently serializes the log records in a binary format. Logstash can't interpret it out of the box, but it wouldn't be too hard to write a custom codec for it.

I'm not a fan of log frameworks talking directly to Logstash. How does Log4cplus behave if it can't reach Logstash?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.