我在java中使用log4j2和splunk将日志发送到我的Splunk Enterprise HEC(HTTP事件收集器)Splunk Enterprise正在我的本地计算机上运行。
我正在以编程的方式进行所有的log4j2配置。(我知道这不是正确的方法,但我仍然是出于学习的目的而这样做)。
我尝试使用相同的URL和令牌将日志直接从 Postman 发送到Splunk Enterprise,它工作正常,但当我尝试使用log4j2从java发送日志时,我在Splunk中没有得到任何内容。
我的代码是=〉
import org.apache.logging.log4j.Level;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.core.config.Configurator;
import org.apache.logging.log4j.core.config.builder.api.ConfigurationBuilder;
import org.apache.logging.log4j.core.config.builder.api.ConfigurationBuilderFactory;
import org.apache.logging.log4j.core.config.builder.impl.BuiltConfiguration;
import org.apache.logging.log4j.core.layout.PatternLayout;
import com.splunk.logging.*;
public class Main {
private static final Logger log;
static {
configureLog4J();
log = LogManager.getLogger(Main.class);
}
public static void configureLog4J() {
ConfigurationBuilder<BuiltConfiguration> builder =
ConfigurationBuilderFactory.newConfigurationBuilder();
// configure a splunk appender
builder.add(
builder.newAppender("splunkH", "SplunkHttp")
.add(
builder.newLayout(PatternLayout.class.getSimpleName())
.addAttribute(
"pattern",
"%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"
)
)
.addAttribute("sourcetype", "log4j2")
.addAttribute("index", "main")
.addAttribute("url", "http://localhost:8088/services/collector") //I tried this url in postman and its working fine there
.addAttribute("token", "xxx")
.addAttribute("disableCertificateValidation", "true")
);
// configure the root logger
builder.add(
builder.newRootLogger(Level.INFO)
.add(builder.newAppenderRef("splunkH"))
);
// apply the configuration
Configurator.initialize(builder.build());
}//end of configureLog4J
public static void main(String ar[]) {
log.log(Level.INFO, "Hello from log4j2");
log.log(Level.ERROR, "Error from log4j2");
}//end of main method
}//end of class
我POM文件
<dependencies>
<dependency>
<groupId>com.splunk.logging</groupId>
<artifactId>splunk-library-javalogging</artifactId>
<version>1.11.4</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.11.2</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.11.2</version>
</dependency>
<dependency>
<groupId>com.splunk</groupId>
<artifactId>splunk</artifactId>
<version>1.6.5.0</version>
</dependency>
</dependencies>
<repositories>
<repository>
<id>splunk-artifactory</id>
<name>Splunk Releases</name>
<url>https://splunk.jfrog.io/splunk/ext-releases-local</url>
</repository>
</repositories>
我在splunk中看不到任何日志。我错过了什么吗?
1条答案
按热度按时间5m1hhzi41#
添加
.addAttribute("batch_size_count", "1")
或循环生成10条日志消息,因为这是batch_size_count
的默认值。这在splunk文档的“配置Log4j 2”一节中进行了解释。顺便说一句,我认为服务/收集器端点应该与JSON消息一起使用(例如
.add(builder.newLayout("JSONLayout"))
)。另外,您使用的log4j 2版本存在Log 4Shell(CVE-2021-44228)漏洞。它已经在2.15.0
中修复,请切换到该版本和最新版本2.17.2
之间的任何版本。最后,我分享了How to configure log4j 2.x purely programmatically?问题的答案,即当以编程方式配置log4j 2时使用它很麻烦。我在集群环境中使用它时遇到了问题,切换到文件配置解决了我的所有问题。