Class: LogStash::Inputs::Log4j

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/inputs/log4j.rb

Overview

Read events over a TCP socket from a Log4j SocketAppender. This plugin works only with log4j version 1.x.

Can either accept connections from clients or connect to a server, depending on ‘mode`. Depending on which `mode` is configured, you need a matching SocketAppender or a SocketHubAppender on the remote side.

One event is created per received log4j LoggingEvent with the following schema:

  • ‘timestamp` => the number of milliseconds elapsed from 1/1/1970 until logging event was created.

  • ‘path` => the name of the logger

  • ‘priority` => the level of this event

  • ‘logger_name` => the name of the logger

  • ‘thread` => the thread name making the logging request

  • ‘class` => the fully qualified class name of the caller making the logging request.

  • ‘file` => the source file name and line number of the caller making the logging request in a colon-separated format “fileName:lineNumber”.

  • ‘method` => the method name of the caller making the logging request.

  • ‘NDC` => the NDC string

  • ‘stack_trace` => the multi-line stack-trace

Also if the original log4j LoggingEvent contains MDC hash entries, they will be merged in the event as fields.

Instance Method Summary collapse

Constructor Details

#initialize(*args) ⇒ Log4j

Returns a new instance of Log4j.



54
55
56
 
# File 'lib/logstash/inputs/log4j.rb', line 54

def initialize(*args)
  super(*args)
end

Instance Method Details

#add_socket_mixin(socket) ⇒ Object 



178
179
180
 
# File 'lib/logstash/inputs/log4j.rb', line 178

def add_socket_mixin(socket)
  socket.instance_eval { class << self; include ::LogStash::Util::SocketPeer end }
end

#build_client_socket ⇒ Object

def run



172
173
174
175
176
 
# File 'lib/logstash/inputs/log4j.rb', line 172

def build_client_socket
  s = TCPSocket.new(@host, @port)
  add_socket_mixin(s)
  s
end

#create_event(log4j_obj) ⇒ Object 



77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
 
# File 'lib/logstash/inputs/log4j.rb', line 77

def create_event(log4j_obj)
  # NOTE: log4j_obj is org.apache.log4j.spi.LoggingEvent
  event = LogStash::Event.new("message" => log4j_obj.getRenderedMessage)
  event.set("timestamp", log4j_obj.getTimeStamp)
  event.set("path", log4j_obj.getLoggerName)
  event.set("priority", log4j_obj.getLevel.toString)
  event.set("logger_name", log4j_obj.getLoggerName)
  event.set("thread", log4j_obj.getThreadName)
  event.set("class", log4j_obj.getLocationInformation.getClassName)
  event.set("file", log4j_obj.getLocationInformation.getFileName + ":" + log4j_obj.getLocationInformation.getLineNumber)
  event.set("method", log4j_obj.getLocationInformation.getMethodName)
  event.set("NDC", log4j_obj.getNDC) if log4j_obj.getNDC
  event.set("stack_trace", log4j_obj.getThrowableStrRep.to_a.join("\n")) if log4j_obj.getThrowableInformation

  # Add the MDC context properties to event
  if log4j_obj.getProperties
    log4j_obj.getPropertyKeySet.each do |key|
      event.set(key, log4j_obj.getProperty(key))
    end
  end
  return event
end

#register ⇒ Object 



59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/logstash/inputs/log4j.rb', line 59

def register
  require "java"
  require "jruby/serialization"

  begin
    Java::OrgApacheLog4jSpi.const_get("LoggingEvent")
  rescue
    raise(LogStash::PluginLoadingError, "Log4j java library not loaded")
  end

  if server?
    @logger.info("Starting Log4j input listener", :address => "#{@host}:#{@port}")
    @server_socket = TCPServer.new(@host, @port)
  end
  @logger.info("Log4j input")
end

#run(output_queue) ⇒ Object 



152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
 
# File 'lib/logstash/inputs/log4j.rb', line 152

def run(output_queue)
  if server?
    while !stop?
      Thread.start(@server_socket.accept) do |s|
        add_socket_mixin(s)
        @logger.debug? && @logger.debug("Accepted connection", :client => s.peer,
                      :server => "#{@host}:#{@port}")
        handle_socket(s, output_queue)
      end # Thread.start
    end # loop
  else
    while !stop?
      client_socket = build_client_socket
      @logger.debug? && @logger.debug("Opened connection", :client => "#{client_socket.peer}")
      handle_socket(client_socket, output_queue)
    end # loop
  end
rescue IOError
end

#stop ⇒ Object

method used to stop the plugin and unblock pending blocking operatings like sockets and others.



144
145
146
147
148
149
 
# File 'lib/logstash/inputs/log4j.rb', line 144

def stop
  begin
    @server_socket.close if @server_socket && !@server_socket.closed?
  rescue IOError
  end
end