I am trying integrate our product with ELK. I use log4j and socket appender with JsonLayout and I see all my logs in Kibana. But stacktraces I get look like:
"thrown": {
"extendedStackTrace": [
{
"file": "ApacheHttpClient4Handler.java",
"method": "handle",
"line": 187,
"exact": false,
"location": "jersey-apache-client4-1.19.1.jar",
"class": "com.sun.jersey.client.apache4.ApacheHttpClient4Handler",
"version": "1.19.1"
},
{
"file": "EurekaIdentityHeaderFilter.java",
"method": "handle",
"line": 27,
"exact": false,
"location": "eureka-client-1.9.3.jar",
"class": "com.netflix.discovery.EurekaIdentityHeaderFilter",
"version": "1.9.3"
}
],
"localizedMessage": "java.net.ConnectException: Connection refused: connect",
"name": "com.sun.jersey.api.client.ClientHandlerException",
"cause": {
"name": "java.net.ConnectException",
"extendedStackTrace": [
{
"file": "DualStackPlainSocketImpl.java",
"method": "waitForConnect",
"line": -2,
"exact": false,
"location": "?",
"class": "java.net.DualStackPlainSocketImpl",
"version": "1.8.0_121"
},
{
"file": "ApacheHttpClient4Handler.java",
"method": "handle",
"line": 173,
"exact": false,
"location": "jersey-apache-client4-1.19.1.jar",
"class": "com.sun.jersey.client.apache4.ApacheHttpClient4Handler",
"version": "1.19.1"
}
],
"commonElementCount": 29,
"localizedMessage": "Connection refused: connect",
"message": "Connection refused: connect"
},
"commonElementCount": 0,
"message": "java.net.ConnectException: Connection refused: connect"
}
I'm not very familiar with logstash but I'd like to see stacktraces as I'm used to. I took a look on many examples where "grok", "mutate", "json" filter plugins were used but I don't see the exapmle how to merge It the way It looks like a regular stack trace placed to separate tag.
Please advise something to me
I would like to see it like, not exactly but It should be just regular stack trace:
2018-09-04 20:18:37 com.netflix.discovery.DiscoveryClient [ERROR] DiscoveryClient_BOOK-GATEWAY-SERVICE/RUENSUKHOAD2C.was unable to refresh its cache! status = Cannot execute request on any known server com.netflix.discovery.shared.transport.TransportException: Cannot execute request on any known server at com.netflix.discovery.shared.transport.decorator.RetryableEurekaHttpClient.execute(RetryableEurekaHttpClient.java:112) ~[eureka-client-1.9.3.jar:1.9.3] at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.getApplications(EurekaHttpClientDecorator.java:134) ~[eureka-client-1.9.3.jar:1.9.3] at java.lang.Thread.run(Thread.java:745) [?:1.8.0_121] Caused by: java.net.ConnectException: Connection refused: connect at java.net.DualStackPlainSocketImpl.waitForConnect(Native Method) ~[?:1.8.0_121] at java.net.DualStackPlainSocketImpl.socketConnect(DualStackPlainSocketImpl.java:85) ~[?:1.8.0_121] at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:118) ~[httpclient-4.5.6.jar:4.5.6] at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56) ~[httpclient-4.5.6.jar:4.5.6] at com.sun.jersey.client.apache4.ApacheHttpClient4Handler.handle(ApacheHttpClient4Handler.java:173) ~[jersey-apache-client4-1.19.1.jar:1.19.1] ... 29 more
Now My logstash.cong looks like that:
input {
tcp {
port => 9600
codec => json
}
}
filter {
if [thrown] {
ruby {
code => "
event.get('thrown')['extendedStackTrace'].map! { |v| v.map { |k, v| "#{v}" }.join(", ") }
"
}
}
}
output {
elasticsearch { hosts => ["elasticsearch-service:9200"] }
}
And It doesn't work