How to use log4jplus with logstash?


(Durgesh Tanuku) #1

I'm new to logstash.
I'm trying to send logs of my C++ application to logstash using log4cplus library. I need to send some json data from my application to logstash. To start with I have written some piece of code that sends a string to logstash.

Below is my logstash configurations

input {
tcp {
port => 5044
}
}

filter{
}

output {
stdout {
codec => rubydebug
}
}

Below is my code that sends data to logstash and log4cplus configurations.

code :

PropertyConfigurator config(configFile);
config.configure();
std::string msg = "test msg";
Logger root = Logger::getRoot();
LOG4CPLUS_INFO(root,msg);

log4cplus conf :

log4cplus.rootLogger=INFO, SA
log4cplus.appender.SA=log4cplus::SocketAppender
log4cplus.appender.SA.port=5044
log4cplus.appender.SA.host=127.0.0.1
log4cplus.appender.SA.serverName=MyServer
log4cplus.appender.SA.layout=log4cplus::PatternLayout
log4cplus.appender.SA.layout.ConversionPattern=%m%n

I was expecting "test message" to be printed on logstash console. But i was receiving some garbage data as shown below.

{
"@version" => "1",
"host" => "localhost",
"message" => "\u0000\u0000\u0000q\u0003\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004root\u0000\u0000N \u0000\u0000\u0000\u0000\u0000\u0000\u0000\btest msg\u0000\u0000\u0000\u000F140382836238144Z{\u0014N\u0000\u0004\u0003\xC0\u0000\u0000\u0000\u0013../src/property.cpp\u0000\u0000\u00002\u0000\u0000\u0000\u0015int main(int, char**)",
"@timestamp" => 2018-02-07T14:59:26.284Z,
"port" => 47148
}

Can i do something in logstash configurations to get actual message ?
Also is it possible to use log4cplus with logstash for logging ?


(Magnus B├Ąck) #2

Log4cplus's SocketAppender apparently serializes the log records in a binary format. Logstash can't interpret it out of the box, but it wouldn't be too hard to write a custom codec for it.

I'm not a fan of log frameworks talking directly to Logstash. How does Log4cplus behave if it can't reach Logstash?


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.