Hi Jochen, I agree. But the Docker GELF driver creates some useful fields in GELF format. This solution does not require changes in the actual applications running inside Docker. Please, see bellow an example of an Apache log received via GELF:
<https://lh3.googleusercontent.com/-eMNW_V-rkCA/V5onBP5KhlI/AAAAAAAANpI/Iuge_RP9KlEOhUbJ-9XMC1CfRn8haNY4ACLcB/s1600/Capture.PNG> The next step is to create an extractor to parse the Apache message, and the same for other application logs. Cheers, Alexandre Em quinta-feira, 28 de julho de 2016 16:11:06 UTC+1, Jochen Schalanda escreveu: > > Hi Alexandre, > > logstash-gelf will send the log messages directly to Graylog. > > Docker logging is line-based which means that you won't gain anything by > printing your logs (in whatever format) to standard out. > > Cheers, > Jochen > > On Thursday, 28 July 2016 16:03:44 UTC+2, Alexandre Verri wrote: >> >> Hi Jochen, >> >> the logstash-gelf looks great, it has support for many loggers. >> >> But I need to send messages to standard output, in this way, I can change >> the GELF server (or even the transport and log protocol) via Docker logging >> driver. I did't find an example about how to append to standard output >> using logstash-gelf. >> >> Cheers, >> Alexandre >> >> Em quinta-feira, 28 de julho de 2016 14:42:30 UTC+1, Jochen Schalanda >> escreveu: >>> >>> Hi Alexandre, >>> >>> that's not a GELF appender. Please use one of the logging appenders >>> listed on the Graylog Marketplace >>> <https://marketplace.graylog.org/addons?tag=java>. >>> >>> Personally, I'd recommend logstash-gelf >>> <https://marketplace.graylog.org/addons/7ea104bd-519d-4140-a396-ff962314415e> >>> . >>> >>> Cheers, >>> Jochen >>> >>> On Thursday, 28 July 2016 15:32:52 UTC+2, Alexandre Verri wrote: >>>> >>>> Thanks Jochen. >>>> >>>> I am using this: https://github.com/logstash/logstash-logback-encoder >>>> >>>> Now the messages are being formatted as JSON, with no new lines chars. >>>> >>>> Cheers, >>>> Alexandre >>>> >>>> Em quinta-feira, 28 de julho de 2016 14:18:59 UTC+1, Jochen Schalanda >>>> escreveu: >>>>> >>>>> Hi Alexandre, >>>>> >>>>> the Docker GELF driver only supports sending messages line-by-line to >>>>> Graylog. >>>>> >>>>> If you want to receive the complete Java stack trace of an exception >>>>> in one message, you should use one of the existing GELF appenders for the >>>>> logging framework being used in your Java application. See >>>>> https://marketplace.graylog.org/addons?tag=java for a list of GELF >>>>> appenders in the Graylog Marketplace. >>>>> >>>>> Cheers, >>>>> Jochen >>>>> >>>>> On Thursday, 28 July 2016 13:47:55 UTC+2, Alexandre Verri wrote: >>>>>> >>>>>> I would like to know to avoid splitting Java stacktrace messages when >>>>>> using GELF format. >>>>>> >>>>>> I have configured a GELF UDP input in Graylog, and sending messages >>>>>> from application using Docker GELF driver. >>>>>> >>>>>> The problem is that the messages are spplited by new line chars >>>>>> contained in the stacktrace, as you can see bellow: >>>>>> >>>>>> >>>>>> <https://lh3.googleusercontent.com/-6P4MryY-nZc/V5nw4OFqSwI/AAAAAAAANo0/tplxEDSO8CUBRklWx-GKMDvYo0dns4nQQCLcB/s1600/messages.PNG> >>>>>> >>>>>> -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/3a586835-7ca4-44ca-ac90-2614166c7d77%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
