Class: LogStash::Inputs::Log4j

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/inputs/log4j.rb

Overview

Read events over a TCP socket from a Log4j SocketAppender.

Can either accept connections from clients or connect to a server, depending on ‘mode`. Depending on which `mode` is configured, you need a matching SocketAppender or a SocketHubAppender on the remote side.

One event is created per received log4j LoggingEvent with the following schema:

  • ‘timestamp` => the number of milliseconds elapsed from 1/1/1970 until logging event was created.

  • ‘path` => the name of the logger

  • ‘priority` => the level of this event

  • ‘logger_name` => the name of the logger

  • ‘thread` => the thread name making the logging request

  • ‘class` => the fully qualified class name of the caller making the logging request.

  • ‘file` => the source file name and line number of the caller making the logging request in a colon-separated format “fileName:lineNumber”.

  • ‘method` => the method name of the caller making the logging request.

  • ‘NDC` => the NDC string

  • ‘stack_trace` => the multi-line stack-trace

Also if the original log4j LoggingEvent contains MDC hash entries, they will be merged in the event as fields.

Instance Method Summary collapse

Constructor Details

#initialize(*args) ⇒ Log4j

Returns a new instance of Log4j.



54
55
56
 
# File 'lib/logstash/inputs/log4j.rb', line 54

def initialize(*args)
  super(*args)
end

Instance Method Details

#create_event(log4j_obj) ⇒ Object 



77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
 
# File 'lib/logstash/inputs/log4j.rb', line 77

def create_event(log4j_obj)
  # NOTE: log4j_obj is org.apache.log4j.spi.LoggingEvent
  event = LogStash::Event.new("message" => log4j_obj.getRenderedMessage)
  event["timestamp"] = log4j_obj.getTimeStamp
  event["path"] = log4j_obj.getLoggerName
  event["priority"] = log4j_obj.getLevel.toString
  event["logger_name"] = log4j_obj.getLoggerName
  event["thread"] = log4j_obj.getThreadName
  event["class"] = log4j_obj.getLocationInformation.getClassName
  event["file"] = log4j_obj.getLocationInformation.getFileName + ":" + log4j_obj.getLocationInformation.getLineNumber
  event["method"] = log4j_obj.getLocationInformation.getMethodName
  event["NDC"] = log4j_obj.getNDC if log4j_obj.getNDC
  event["stack_trace"] = log4j_obj.getThrowableStrRep.to_a.join("\n") if log4j_obj.getThrowableInformation

  # Add the MDC context properties to event
  if log4j_obj.getProperties
    log4j_obj.getPropertyKeySet.each do |key|
      event[key] = log4j_obj.getProperty(key)
    end
  end
  return event
end

#register ⇒ Object 



59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/logstash/inputs/log4j.rb', line 59

def register
  require "java"
  require "jruby/serialization"

  begin
    Java::OrgApacheLog4jSpi.const_get("LoggingEvent")
  rescue
    raise(LogStash::PluginLoadingError, "Log4j java library not loaded")
  end

  if server?
    @logger.info("Starting Log4j input listener", :address => "#{@host}:#{@port}")
    @server_socket = TCPServer.new(@host, @port)
  end
  @logger.info("Log4j input")
end

#run(output_queue) ⇒ Object 



149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
 
# File 'lib/logstash/inputs/log4j.rb', line 149

def run(output_queue)
  if server?
    while !stop?
      Thread.start(@server_socket.accept) do |s|
        s.instance_eval { class << self; include ::LogStash::Util::SocketPeer end }
        @logger.debug? && @logger.debug("Accepted connection", :client => s.peer,
                      :server => "#{@host}:#{@port}")
        handle_socket(s, output_queue)
      end # Thread.start
    end # loop
  else
    while !stop?
      client_socket = TCPSocket.new(@host, @port)
      client_socket.instance_eval { class << self; include ::LogStash::Util::SocketPeer end }
      @logger.debug? && @logger.debug("Opened connection", :client => "#{client_socket.peer}")
      handle_socket(client_socket, output_queue)
    end # loop
  end
end

#stop ⇒ Object

method used to stop the plugin and unblock pending blocking operatings like sockets and others.



144
145
146
 
# File 'lib/logstash/inputs/log4j.rb', line 144

def stop
  @server_socket.close if @server_socket && !@server_socket.closed?
end