The best and easiest way to get your JBOSS output into ELK is through a socket connector. There are lots of tutorials but it will automatically give you your message breakdown for free.
See this for an example: http://blog.akquinet.de/2015/08/24/logstash-jboss-eap/
Please note that personally I have had to change the appenders and use documentation to get the correct fields. If you are using 2.0 elasticsearch than update the configuration. For simple debugging simple output to stdout.
Once you have the socket appenders working correctly you are laughing and go to kibanan, configure the dashboard with whatever aggregation you would like. I would not recommend breaking it down further as then you have a custom message breakdown that will not apply to a jboss implementation, feel free to add additional value/pairs such as appname.. etc.
SAMPLE:
* jboss-eap-6.4.0.0
* elasticsearch-2.0.0-beta2
* kibana-4.2.0-beta2-windows
* logstash-2.0.0-beta1
Create a file called log4j.conf under logstash/conf dir, i.e. "C:_apps\logstash-2.0.0-beta1\conf\log4j.conf" with the below content.
input {
log4j {
mode => "server"
host => "0.0.0.0"
port => 4712
type => "log4j"
}
}
output {
elasticsearch {
hosts => "127.0.0.1"
#cluster => "myAppName"
index => "logstash-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug }
}
Run Logstash with the following command prompt within dir:
bin\logstash.bat -f conf\log4j.conf
Configuring Appenders:
JBOSS APPENDER
Within the profile:
<custom-handler name="Remotelog4j" class="org.apache.log4j.net.SocketAppender" module="org.apache.log4j">
<level name="INFO"/>
<properties>
<property name="RemoteHost" value="localhost"/>
<property name="Port" value="4712"/>
<!--property name="BufferSize" value="1000"/-->
<!--property name="Blocking" value="false"/-->
</properties>
</custom-handler>
within the root loggger configuration define your handlers:
<root-logger>
<level name="INFO"/>
<handlers>
<handler name="CONSOLE"/>
<handler name="FILE"/>
<handler name="Remotelog4j"/>
</handlers>
</root-logger>
Start JBOSS, note that your command prompt is printing out all the incoming messages from your standalone JBOSS instance.
Configuring Another Application with OLD Log4J
Log4J version log4j-1.2.15.jar
Inside the packaged WAR I created this simple additional log4j appender:
<appender name="log4jSocket" class="org.apache.log4j.net.SocketAppender" module="org.apache.log4j">
<level name="ERROR"/>
<param name="RemoteHost" value="localhost"/>
<param name="Port" value="4712"/>
<param name="threshold" value="ERROR" />
</appender>
Again, add the appender to your application log4j loggers.
<logger name="com.somepackage" additivity="false">
<level value="error"/>
<appender-ref ref="default"/>
<appender-ref ref="event"/>
<appender-ref ref="log4jSocket"/>
</logger>
Now restart your jboss configuration and deploy/start your application inside JBOSS. You will get both jboss output and application output inside of logstash value/paired nicely.
