When i use logstash-gelf to provide log messages, i find some messages lost


(Swelltt0576) #1

i sent 100,000 message, but there are only about 80,000 messages in the logstash.

what happend?

this is my log4j2 configuration:

    <Gelf name="gelf" host="${log4j.logstash}" port="12201" version="1.1" extractStackTrace="true"
              filterStackTrace="true" mdcProfiling="true" includeFullMdc="true" maximumMessageSize="8192"
              originHost="%host{fqdn}">
            <Field name="timestamp" pattern="%d{dd MMM yyyy HH:mm:ss,SSS}" />
            <Field name="level" pattern="%level" />
            <Field name="simpleClassName" pattern="%C{1}" />
            <Field name="className" pattern="%C" />
            <Field name="server" pattern="%host" />
<!--             <Field name="server.fqdn" pattern="%host{fqdn}" /> -->

            <!-- This is a static field -->
            <Field name="fieldName2" literal="fieldValue2" />

            <!-- This is a field using MDC -->
            <Field name="mdcField2" mdc="mdcField2" /> 
            <DynamicMdcFields regex="mdc.*" />
            <DynamicMdcFields regex="(mdc|MDC)fields" />
        </Gelf>

(Mark Walkom) #2

Providing your LS config would also help.


(Swelltt0576) #3

hi,this is my LS conifg.

input {
   gelf{
        host => "10.1.51.7"
        port => 12201
    }
}

filter {
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }
  #stdout { codec => rubydebug }
}


(system) #4