# Log4j input plugin **URL:** \ **Category:** Logstash\ **Created:** [September 11, 2017, 5:19pm UTC](https://discuss.elastic.co/t/log4j-input-plugin/100104 "2017-09-11T17:19:15Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![xiaopeng\_zhang](https://avatars.discourse-cdn.com/v4/letter/x/71e660/32.png) [@xiaopeng\_zhang](https://discuss.elastic.co/u/xiaopeng_zhang)\ **Post date:** [September 11, 2017, 5:19pm UTC](https://discuss.elastic.co/t/log4j-input-plugin/100104/1 "2017-09-11T17:19:15Z")
I know it's deprecated.i just wang to use it Conveniently. when i use [it.it](http://it.it) run [normally.it](http://normally.it) doesn/t accept any log. input { log4j { mode =\> "server" port =\> 80 } } but when i use tcp .it get log and there are many \u0000 in it. tcp config: input { tcp { port =\> 80 mode =\> "server" ssl\_enable =\> false type =\> "log4j-json" } } do you have any suggestion ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 11, 2017, 6:29pm UTC](https://discuss.elastic.co/t/log4j-input-plugin/100104/2 "2017-09-11T18:29:25Z")
> when i use it.it run normally.it doesn/t accept any log. Are there any clues in the Logstash log? > but when i use tcp .it get log and there are many \u0000 in it. Yes, that's expected. ---
**Author:** ![xiaopeng\_zhang](https://avatars.discourse-cdn.com/v4/letter/x/71e660/32.png) [@xiaopeng\_zhang](https://discuss.elastic.co/u/xiaopeng_zhang)\ **Post date:** [September 12, 2017, 12:43am UTC](https://discuss.elastic.co/t/log4j-input-plugin/100104/3 "2017-09-12T00:43:07Z")
[2017-09-11T17:21:58,366][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>[], :added=\>[[http://172.16.10.5:8802/](http://172.16.10.5:8802/)]}} [2017-09-11T17:21:58,371][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://172.16.10.5:8802/](http://172.16.10.5:8802/), :path=\>"/"} [2017-09-11T17:21:58,465][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#Java::JavaNet::URI:0x1914f8e7} [2017-09-11T17:21:58,466][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil} [2017-09-11T17:21:58,508][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}} [2017-09-11T17:21:58,516][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>[#Java::JavaNet::URI:0x332bd20]} [2017-09-11T17:21:58,520][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>24, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>3000} [2017-09-11T17:21:58,564][WARN][logstash.inputs.log4j] This plugin is deprecated. Please use filebeat instead to collect logs from log4j applications. [2017-09-11T17:21:58,565][INFO][logstash.inputs.log4j] Starting Log4j input listener {:address=\>"0.0.0.0:80"} [2017-09-11T17:21:58,571][INFO][logstash.inputs.log4j] Log4j input [2017-09-11T17:21:58,572][INFO][logstash.pipeline] Pipeline main started [2017-09-11T17:21:58,608][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2017-09-11T17:34:25,292][WARN][logstash.runner] SIGINT received. Shutting down the agent. [2017-09-11T17:34:25,307][WARN][logstash.agent] stopping pipeline {:id=\>"main"} it doesn/t tell me any error.can you find something. i really need it .i want a Remote Connection in the client rather than by a file. ---
**Author:** ![xiaopeng\_zhang](https://avatars.discourse-cdn.com/v4/letter/x/71e660/32.png) [@xiaopeng\_zhang](https://discuss.elastic.co/u/xiaopeng_zhang)\ **Post date:** [September 12, 2017, 2:01am UTC](https://discuss.elastic.co/t/log4j-input-plugin/100104/4 "2017-09-12T02:01:09Z")
hey.I find sth on other website.someone said thar error common occurredin logstash 5.x. So i try a past releases. When i use the 2.4.0 .it can work! root@bd1c91e02892:/usr/logstash-2.4.0# bin/logstash -f hd-citos-log4j.conf Settings: Default pipeline workers: 24 log4j:WARN No appenders could be found for logger (org.apache.http.client.protocol.RequestAuthCache). log4j:WARN Please initialize the log4j system properly. log4j:WARN See [http://logging.apache.org/log4j/1.2/faq.html#noconfig](http://logging.apache.org/log4j/1.2/faq.html#noconfig) for more info. Pipeline main started { "message" =\> "This is a debug message!", "@version" =\> "1", "@timestamp" =\> "2017-09-12T01:54:28.039Z", "timestamp" =\> 1505181267997, "path" =\> "edu.zxp.log4jlearn.log4jTest", "priority" =\> "DEBUG", "logger\_name" =\> "edu.zxp.log4jlearn.log4jTest", "thread" =\> "main", "class" =\> "edu.zxp.log4jlearn.log4jTest", "file" =\> "log4jTest.java:9", "method" =\> "main", "host" =\> "10.18.12.222:55173" } { "message" =\> "This is info message!", "@version" =\> "1", "@timestamp" =\> "2017-09-12T01:54:28.081Z", "timestamp" =\> 1505181268007, "path" =\> "edu.zxp.log4jlearn.log4jTest", "priority" =\> "INFO", "logger\_name" =\> "edu.zxp.log4jlearn.log4jTest", "thread" =\> "main", "class" =\> "edu.zxp.log4jlearn.log4jTest", "file" =\> "log4jTest.java:10", "method" =\> "main", "host" =\> "10.18.12.222:55173" } { "message" =\> "This is a warn message!", "@version" =\> "1", "@timestamp" =\> "2017-09-12T01:54:28.082Z", "timestamp" =\> 1505181268008, "path" =\> "edu.zxp.log4jlearn.log4jTest", "priority" =\> "WARN", "logger\_name" =\> "edu.zxp.log4jlearn.log4jTest", "thread" =\> "main", "class" =\> "edu.zxp.log4jlearn.log4jTest", "file" =\> "log4jTest.java:11", "method" =\> "main", "host" =\> "10.18.12.222:55173" } { "message" =\> "This is error message!", "@version" =\> "1", "@timestamp" =\> "2017-09-12T01:54:28.083Z", "timestamp" =\> 1505181268008, "path" =\> "edu.zxp.log4jlearn.log4jTest", "priority" =\> "ERROR", "logger\_name" =\> "edu.zxp.log4jlearn.log4jTest", "thread" =\> "main", "class" =\> "edu.zxp.log4jlearn.log4jTest", "file" =\> "log4jTest.java:12", "method" =\> "main", "host" =\> "10.18.12.222:55173" } So .do you have any suggestion about the logstash 5.5.0.Beacuse i use the elasticsearch5.5.0 and kibana 5.5.0 . I want to avoid version conflicts. Sorry for my bad English ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 12, 2017, 3:26am UTC](https://discuss.elastic.co/t/log4j-input-plugin/100104/5 "2017-09-12T03:26:26Z")
I don't know why it isn't working in Logstash 5.5, but I do want to stress that the path you want to choose is not recommended and that problems like this are to be expected. You really really should pick another way of doing this. You can e.g. serialize the log event as JSON and ship over TCP. Then you can use a tcp input to receive it on the Logstash side. I know there's at least one Java library suitable for that. ---
**Author:** ![xiaopeng\_zhang](https://avatars.discourse-cdn.com/v4/letter/x/71e660/32.png) [@xiaopeng\_zhang](https://discuss.elastic.co/u/xiaopeng_zhang)\ **Post date:** [September 12, 2017, 12:55pm UTC](https://discuss.elastic.co/t/log4j-input-plugin/100104/6 "2017-09-12T12:55:10Z")
thank [you.do](http://you.do) you have a demo about log4j.properties?. because i truly know little about it.I don/t how to use the Json log4j. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 10, 2017, 12:55pm UTC](https://discuss.elastic.co/t/log4j-input-plugin/100104/7 "2017-10-10T12:55:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.