You're showing a logstash parsing, extracted from a message formatted using syslog. All the magic should be in the pattern line (log4j.appender.myappender.layout.ConversionPattern=[%c] %m%). And logstash failed to parse the line anyway (see the _grokparsefailure). Did you try to send native log4j event to logstash, using custom appenders like my own : https://github.com/fbacchella/ZMQAppender
Le 11 mai 2016 à 08:20, Dominique Taffin <dominique.taffin@1und1.de> a écrit :
Hello!
Thank you for your reply. Unfortunately, it does not include the hostname with header=true. The following is received by the logserver:
{ "_index": "ovirt-2016.05.11", "_type": "syslog", "_id": "AVSedM6EH9SU2r3j0ihk", "_score": null, "_source": { "message": "<14>[org.ovirt.engine.core.vdsbroker.HostDevListByCapsVDSCommand] START, HostDevListByCapsVDSCommand(HostName = onodeXXX.some.domain, VdsIdAndVdsVDSCommandParametersBase:{runAsync='true', hostId='XXXXXXXX-XXX-XXXX-XXXX-XXXXXXXXXXX', vds='Host[onodeXXX.some.domain,XXXXXXXX-XXX-XXXX-XXXX-XXXXXXXXXXX]'}), log id: 689d5b30\n", "@version": "1", "@timestamp": "2016-05-11T08:15:35.729+02:00", "type": "syslog", "host": "10.XXX.XXX.XXX", "tags": [ "_grokparsefailure" ], "syslog_severity_code": 5, "syslog_facility_code": 1, "syslog_facility": "user-level", "syslog_severity": "notice" }, "sort": [ 1462947335729, 1462947335729 ] }
is it possible to have the IP in the "host" filed have resolved from log4j so that the hostname will be displayed there? Or have it convinced to use the appender.Application field?
thank you and best, Dominique
Von: Ravi Nori <rnori@redhat.com> Gesendet: Dienstag, 10. Mai 2016 19:04 An: Dominique Taffin Cc: users@oVirt.org Betreff: Re: [ovirt-users] Log4j hostname
Hi Dominique,
Add
log4j.appender.myappender.header = true
and see if you get the hostname
Ravi
On Mon, May 9, 2016 at 9:37 AM, Dominique Taffin <dominique.taffin@1und1.de> wrote: Hello!
We are using the log4j extension to send ovirt logs to a logstash server. As we do have several engine hosts and only one logging backend, we do need to filter logs by hostname. So far I am unable to provide a hostname in Log4jLogger.properties. All Log4j configurations we have in other applications/servers to honor the log4j.Application property. I tried setting it up by:
ovirt.engine.extension.name = Log4j ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.logger.Logger ovirt.engine.extension.bindings.method = jbossmodule ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.logger.log4j ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.logger.log4j.Log4jLogger log4j.rootLogger=DEBUG, myappender
log4j.appender.myappender = org.apache.log4j.net.SyslogAppender log4j.appender.myappender.SyslogHost = logstash-server.something log4j.appender.myappender.Port = 5544 log4j.appender.myappender.ReconnectionDelay = 60000 log4j.appender.myappender.Application = ovirthostname log4j.appender.myappender.LocationInfo = true log4j.appender.myappender.Threshold = DEBUG log4j.appender.myappender.layout = org.apache.log4j.PatternLayout log4j.appender.myappender.layout.ConversionPattern=[%c] %m%n
Logs do arrive, but no hostname. Can anyone point me out on how to include the hostname in the logs?
thank you and best, Dominique
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users