Direct logback logs to graylog

Question

I have a third party java application which uses logback for logging.

I want to add a Socket Appender to the application's logback.xml as specified in the documentation (https://logback.qos.ch/manual/appenders.html)

<configuration debug="true">
  <appender name="SERVER" 
    class="ch.qos.logback.classic.net.server.ServerSocketAppender">
    <port>${port}</port>
    <includeCallerData>${includeCallerData}</includeCallerData>
  </appender>

  <root level="debug">
    <appender-ref ref="SERVER" />
  </root>  

</configuration>

The purpose is to direct the logs to graylog using udp end point. Is there a way to send the logs using the UDP protocol ?

Thanks for your time.

score 3 · Answer 1 · answered Jul 13 '18 at 06:45

3

There are multiple GELF appenders for Logback listed on the Graylog Marketplace: https://marketplace.graylog.org/addons?tag=logback

Personally, I'd recommend using logstash-gelf.

answered Jul 13 '18 at 06:45

joschi

12,746
4
44
50

Thanks joschi for your time and response. Unfortunately these gelf appenders seem to have dependencies. However I do not have the option of recompiling the third party application. The socket appender is something I could add right in the logback.xml without doing anything else. – VenVig Jul 13 '18 at 20:15
Most of these appenders provide a shaded artifact without transitive dependencies or have no transitive dependencies in the first place, such as [logstash-gelf](https://github.com/mp911de/logstash-gelf). – joschi Jul 15 '18 at 10:52

score 2 · Answer 2 · answered Jul 18 '18 at 16:29

I created a TCP Socket Server application (say on port 1234 running on localhost).

I added a socket appender to the logback.xml of the third party application to send logs to the TCP Server application.

 <appender name="SOCKET" class="ch.qos.logback.classic.net.SocketAppender">
    <remoteHost>localhost</remoteHost>
    <port>1234</port>
    <reconnectionDelay>10000</reconnectionDelay>
    <includeCallerData>true</includeCallerData>
</appender>

Now, on the Socket server application, I added the logstash-gelf dependency and appender that joschi recommended. Now the logs from the third party application go thru a hop and then reach Graylog.

The one caveat that I had to get around was to determine the severity of the log from the log message before logging it again in the socket server application.

Direct logback logs to graylog

2 Answers2

Linked