I'm a bit confused on how can I put my log entries directly to elasticsearch
(not logstash). So far I found a few appenders (log4j.appender.SocketAppender
, log4j.appender.server
etc.) that allow to send logs to remote host and also ConversionPattern
possibility that seems to allow us to convert logs to "elastic-friendly" format, but this approach looks freaky... or do I mistake? Is this the one way to send logs to elastic
?
So far I have a such config:
log4j.rootLogger=DEBUG, server
log4j.appender.server=org.apache.log4j.net.SocketAppender
log4j.appender.server.Port=9200
log4j.appender.server.RemoteHost=localhost
log4j.appender.server.ReconnectionDelay=10000
log4j.appender.server.layout.ConversionPattern={"debug_level":"%p","debug_timestamp":"%d{ISO8601}","debug_thread":"%t","debug_file":"%F", "debug_line":"%L","debug_message":"%m"}%n
But I get an error:
log4j:WARN Detected problem with connection: java.net.SocketException: Broken pipe (Write failed)
I can't find any useful example so I can't understand what do I do wrong and how to fix it. Thanks.
If you point logstash to this file
.. .so this means I'll write logs to a file and that's not what I need