<div dir="ltr"><div>Please also make sure that the hostname can be resolved.<br><br></div>Try running &#39;hostname&#39; as unprivileged user to make sure the machine can resolve the local host name.<br><br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 11, 2016 at 3:29 AM, Fabrice Bacchella <span dir="ltr">&lt;<a href="mailto:fabrice.bacchella@orange.fr" target="_blank">fabrice.bacchella@orange.fr</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">You&#39;re showing a logstash parsing, extracted from a message formatted using syslog. All the magic should be in the pattern line (log4j.appender.myappender.layout.ConversionPattern=[%c] %m%).<br>
And logstash failed to parse the line anyway (see the _grokparsefailure).<br>
<br>
Did you try to send native log4j event to logstash, using custom appenders like my own : <a href="https://github.com/fbacchella/ZMQAppender" rel="noreferrer" target="_blank">https://github.com/fbacchella/ZMQAppender</a><br>
<div class="HOEnZb"><div class="h5"><br>
<br>
&gt; Le 11 mai 2016 à 08:20, Dominique Taffin &lt;<a href="mailto:dominique.taffin@1und1.de">dominique.taffin@1und1.de</a>&gt; a écrit :<br>
&gt;<br>
&gt; Hello!<br>
&gt;<br>
&gt; Thank you for your reply. Unfortunately, it does not include the hostname with header=true.<br>
&gt; The following is received by the logserver:<br>
&gt;<br>
&gt; {<br>
&gt;   &quot;_index&quot;: &quot;ovirt-2016.05.11&quot;,<br>
&gt;   &quot;_type&quot;: &quot;syslog&quot;,<br>
&gt;   &quot;_id&quot;: &quot;AVSedM6EH9SU2r3j0ihk&quot;,<br>
&gt;   &quot;_score&quot;: null,<br>
&gt;   &quot;_source&quot;: {<br>
&gt;     &quot;message&quot;: &quot;&lt;14&gt;[org.ovirt.engine.core.vdsbroker.HostDevListByCapsVDSCommand] START, HostDevListByCapsVDSCommand(HostName = onodeXXX.some.domain, VdsIdAndVdsVDSCommandParametersBase:{runAsync=&#39;true&#39;, hostId=&#39;XXXXXXXX-XXX-XXXX-XXXX-XXXXXXXXXXX&#39;, vds=&#39;Host[onodeXXX.some.domain,XXXXXXXX-XXX-XXXX-XXXX-XXXXXXXXXXX]&#39;}), log id: 689d5b30\n&quot;,<br>
&gt;     &quot;@version&quot;: &quot;1&quot;,<br>
&gt;     &quot;@timestamp&quot;: &quot;2016-05-11T08:15:35.729+02:00&quot;,<br>
&gt;     &quot;type&quot;: &quot;syslog&quot;,<br>
&gt;     &quot;host&quot;: &quot;10.XXX.XXX.XXX&quot;,<br>
&gt;     &quot;tags&quot;: [<br>
&gt;       &quot;_grokparsefailure&quot;<br>
&gt;     ],<br>
&gt;     &quot;syslog_severity_code&quot;: 5,<br>
&gt;     &quot;syslog_facility_code&quot;: 1,<br>
&gt;     &quot;syslog_facility&quot;: &quot;user-level&quot;,<br>
&gt;     &quot;syslog_severity&quot;: &quot;notice&quot;<br>
&gt;   },<br>
&gt;   &quot;sort&quot;: [<br>
&gt;     1462947335729,<br>
&gt;     1462947335729<br>
&gt;   ]<br>
&gt; }<br>
&gt;<br>
&gt; is it possible to have the IP in the &quot;host&quot; filed have resolved from log4j so that the hostname will be displayed there? Or have it convinced to use the appender.Application field?<br>
&gt;<br>
&gt; thank you and best,<br>
&gt;  Dominique<br>
&gt;<br>
</div></div><div class="HOEnZb"><div class="h5">&gt; Von: Ravi Nori &lt;<a href="mailto:rnori@redhat.com">rnori@redhat.com</a>&gt;<br>
&gt; Gesendet: Dienstag, 10. Mai 2016 19:04<br>
&gt; An: Dominique Taffin<br>
&gt; Cc: users@oVirt.org<br>
&gt; Betreff: Re: [ovirt-users] Log4j hostname<br>
&gt;<br>
&gt; Hi Dominique,<br>
&gt;<br>
&gt; Add<br>
&gt;<br>
&gt; log4j.appender.myappender.header = true<br>
&gt;<br>
&gt; and see if you get the hostname<br>
&gt;<br>
&gt; Ravi<br>
&gt;<br>
&gt;<br>
&gt; On Mon, May 9, 2016 at 9:37 AM, Dominique Taffin &lt;<a href="mailto:dominique.taffin@1und1.de">dominique.taffin@1und1.de</a>&gt; wrote:<br>
&gt; Hello!<br>
&gt;<br>
&gt; We are using the log4j extension  to send ovirt logs to a logstash server.<br>
&gt; As we do have several engine hosts and only one logging backend, we do need to filter logs by hostname. So far I am unable to provide a hostname in<br>
&gt; Log4jLogger.properties. All Log4j configurations we have in other applications/servers to honor the log4j.Application property. I tried setting it up by:<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; <a href="http://ovirt.engine.extension.name" rel="noreferrer" target="_blank">ovirt.engine.extension.name</a> = Log4j<br>
&gt; ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.logger.Logger<br>
&gt; ovirt.engine.extension.bindings.method = jbossmodule<br>
&gt; ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.logger.log4j<br>
&gt; ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.logger.log4j.Log4jLogger<br>
&gt; log4j.rootLogger=DEBUG, myappender<br>
&gt;<br>
&gt; log4j.appender.myappender = org.apache.log4j.net.SyslogAppender<br>
&gt; log4j.appender.myappender.SyslogHost = logstash-server.something<br>
&gt; log4j.appender.myappender.Port = 5544<br>
&gt; log4j.appender.myappender.ReconnectionDelay = 60000<br>
&gt; log4j.appender.myappender.Application = ovirthostname<br>
&gt; log4j.appender.myappender.LocationInfo = true<br>
&gt; log4j.appender.myappender.Threshold = DEBUG<br>
&gt; log4j.appender.myappender.layout = org.apache.log4j.PatternLayout<br>
&gt; log4j.appender.myappender.layout.ConversionPattern=[%c] %m%n<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; Logs do arrive, but no hostname. Can anyone point me out on how to include the hostname in the logs?<br>
&gt;<br>
&gt; thank you and best,<br>
&gt;  Dominique<br>
&gt;<br>
&gt; _______________________________________________<br>
&gt; Users mailing list<br>
&gt; <a href="mailto:Users@ovirt.org">Users@ovirt.org</a><br>
&gt; <a href="http://lists.ovirt.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a><br>
&gt;<br>
&gt;<br>
&gt; _______________________________________________<br>
&gt; Users mailing list<br>
&gt; <a href="mailto:Users@ovirt.org">Users@ovirt.org</a><br>
&gt; <a href="http://lists.ovirt.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a><br>
<br>
</div></div></blockquote></div><br></div>