Using the syslog appender in elasticsearch

I'm trying to log the Elasticsearch output via syslog to Papertrail.
The rest of the machine works just fine already - all syslog output
automatically goes to them via this rule:

. @logs.papertrailapp.com:xxxxx

Here is my ES logging config:

Nothing from Elasticsearch makes it over to Papertrail.

Anybody ever dealt with this?

Any pointers?

Hi,

you have to put 'syslog' in your rootLogger

Ludo

On Thu, Dec 29, 2011 at 4:52 AM, Darron Froese darron@nonfiction.ca wrote:

I'm trying to log the Elasticsearch output via syslog to Papertrail.
The rest of the machine works just fine already - all syslog output
automatically goes to them via this rule:

. @logs.papertrailapp.com:xxxxx

Here is my ES logging config:

http://d.pr/pXwe

Nothing from Elasticsearch makes it over to Papertrail.

Anybody ever dealt with this?

Any pointers?

Hmm - I've done that - it doesn't seem to work:

I think I'm putting things in the right place - any other ideas?

On Thu, Dec 29, 2011 at 7:47 AM, Ludovic Levesque luddic@gmail.com wrote:

Hi,

you have to put 'syslog' in your rootLogger

Ludo

On Thu, Dec 29, 2011 at 4:52 AM, Darron Froese darron@nonfiction.ca wrote:

I'm trying to log the Elasticsearch output via syslog to Papertrail.
The rest of the machine works just fine already - all syslog output
automatically goes to them via this rule:

. @logs.papertrailapp.com:xxxxx

Here is my ES logging config:

http://d.pr/pXwe

Nothing from Elasticsearch makes it over to Papertrail.

Anybody ever dealt with this?

Any pointers?

Do you see anything failing on the console output (run it in
the foreground)? I've never used log4j with syslog, but your config looks
good.

On Thu, Dec 29, 2011 at 9:33 PM, Darron Froese darron@nonfiction.ca wrote:

Hmm - I've done that - it doesn't seem to work:

http://d.pr/yPkr

I think I'm putting things in the right place - any other ideas?

On Thu, Dec 29, 2011 at 7:47 AM, Ludovic Levesque luddic@gmail.com
wrote:

Hi,

you have to put 'syslog' in your rootLogger

Ludo

On Thu, Dec 29, 2011 at 4:52 AM, Darron Froese darron@nonfiction.ca
wrote:

I'm trying to log the Elasticsearch output via syslog to Papertrail.
The rest of the machine works just fine already - all syslog output
automatically goes to them via this rule:

. @logs.papertrailapp.com:xxxxx

Here is my ES logging config:

http://d.pr/pXwe

Nothing from Elasticsearch makes it over to Papertrail.

Anybody ever dealt with this?

Any pointers?

Bumping this old thread with new info:

Darron's config is actually right on, except for one tiny thing. The
sysloghost line actually has to read: "syslogHost", with a capital H.
Works like a charm after that.

:slight_smile:

On Friday, December 30, 2011 7:38:07 AM UTC-5, kimchy wrote:

Do you see anything failing on the console output (run it in
the foreground)? I've never used log4j with syslog, but your config looks
good.

On Thu, Dec 29, 2011 at 9:33 PM, Darron Froese <dar...@nonfiction.ca<javascript:>

wrote:

Hmm - I've done that - it doesn't seem to work:

http://d.pr/yPkr

I think I'm putting things in the right place - any other ideas?

On Thu, Dec 29, 2011 at 7:47 AM, Ludovic Levesque <lud...@gmail.com<javascript:>>
wrote:

Hi,

you have to put 'syslog' in your rootLogger

Ludo

On Thu, Dec 29, 2011 at 4:52 AM, Darron Froese <dar...@nonfiction.ca<javascript:>>
wrote:

I'm trying to log the Elasticsearch output via syslog to Papertrail.
The rest of the machine works just fine already - all syslog output
automatically goes to them via this rule:

. @logs.papertrailapp.com:xxxxx

Here is my ES logging config:

http://d.pr/pXwe

Nothing from Elasticsearch makes it over to Papertrail.

Anybody ever dealt with this?

Any pointers?

--

Can someone post the working logging.yml for this?

I tried with

syslog:
type: syslog
sysloghost: localhost
facility: local1
layout:
type: pattern
conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"

But nothing got pushed to syslog. My logs are going to /var/log/elasticsearch.log but nothing goes to syslog.

I need to push them to papertrail later using simple rsyslog forwarding.