Log4j input

Elastic Stack Logstash
1

I have tried to input several log4j messages, generated by our internal apps, into logstash with no luck. If I can to a TCP input on port 4560, it works. Do I need a specific log4j message format?

I have searched extensively and read this page:

https://www.elastic.co/guide/en/logstash/current/plugins-inputs-log4j.html#plugins-inputs-log4j-type?q=log4j

But no luck so far.

2

Are you using SocketAppender on the Java side? That's what the log4j input is meant to be used with.

3

Yes, I had a Java Dev add the socketappender code to one of our apps. I have been testing with nc (netcat) as well.

4

IIRC the log4j input expects to receive serialized Java objects in which case netcat tests aren't very useful.