如何通过 Log4j2 将日志发送到 Graylog？

Question

I'm trying to integrate a java application with a graylog server on the docker. but I'm not able to send messages from my application to graylog, can someone help me?

Here is my Docker Run :

$ docker run --name mongo -d mongo:3
$ docker run --name elasticsearch \
    -e "http.host=0.0.0.0" \
    -e "ES_JAVA_OPTS=-Xms512m -Xmx512m" \
    -d docker.elastic.co/elasticsearch/elasticsearch-oss:6.8.10
$ docker run --name graylog --link mongo --link elasticsearch \
    -p 9000:9000 -p 12201:12201 -p 1514:1514 \
    -e GRAYLOG_HTTP_EXTERNAL_URI="http://127.0.0.1:9000/" \
    -d graylog/graylog:3.3

here is my Input config inside Graylog

Graylog Input

here is the application tutorial i am using: https://talhature.com/2020/04/25/using-graylog-with-log4j2/

here is my log4j2.xml

<?xml version="1.0" encoding="UTF-8" ?>
<Configuration status="TRACE" monitorInterval="180">
    <Properties>
        <Property name="app-name">graylog-example-fatjar</Property>

        <!-- CHANGE log-path ACCORDING TO YOUR NEEDS -->
        <Property name="log-path">$${sys:application-directory}/${app-name}/log
        </Property>
        <Property name="log-pattern">[%sn] %d{yyyy/MM/dd HH:mm:ss,SSS} [%-6p] [%t]
            %c{3}:%L - %m%n</Property>
    </Properties>

    <!-- CHANGE HOST AND PORT PROPERTIES ACCORDING TO YOUR NEEDS -->
    <Appenders>
        <Gelf name="gelf" host="udp:127.0.0.1" port="12201"
            version="1.1" extractStackTrace="true" filterStackTrace="true"
            mdcProfiling="true" includeFullMdc="true" maximumMessageSize="8192"
            originHost="%host{fqdn}">

            <!-- THESE FIELD DEFINITIONS ARE NOT MANDATORY, YOU CAN USE DEFAULTS -->
            <Field name="timestamp" pattern="%d{dd MMM yyyy HH:mm:ss,SSS}" />
            <Field name="level" pattern="%level" />
            <Field name="simpleClassName" pattern="%C{1}" />
            <Field name="className" pattern="%C" />
            <Field name="server" pattern="%host" />
            <Field name="server.fqdn" pattern="%host{fqdn}" />

            <!-- THESE ARE MY CUSTOM GRAYLOG FIELDS -->
            <Field name="logStream" literal="MYAWESOMEAPPS" />
            <Field name="projectName" literal="MYAWESOMEPROJECT" />
        </Gelf>
        <RollingFile name="RollingFile"
            fileName="${log-path}/server/${app-name}-server"
            filePattern="${log-path}/server/${app-name}-server-%d{yyyy-MM-dd}-%i.log.gz"
            append="false">
            <PatternLayout>
                <pattern>${log-pattern}</pattern>
            </PatternLayout>
            <Policies>
                <SizeBasedTriggeringPolicy size="100 MB" />
            </Policies>
        </RollingFile>
    </Appenders>

    <Loggers>
        <Root level="INFO" additivity="false" includeLocation="true">
            <AppenderRef ref="RollingFile" />
            <AppenderRef ref="gelf" />
        </Root>
    </Loggers>
</Configuration>

* SOLUTION

up my docker this way to open a port 5555:

$ docker run --link mongo --link elasticsearch \
    -p 9000:9000 -p 12201:12201 -p 1514:1514 -p 5555:5555 \
    -e GRAYLOG_HTTP_EXTERNAL_URI="http://127.0.0.1:9000/" \
    -d graylog/graylog:3.3

in my log4j2.xml i change the line 7:

<Gelf name="Gelf" host="tcp:127.0.0.1" port="5555" version="1.1"

and my Graylog Input (Gelf:TCP): Graylog Input Gelf TCP

Answer 1

Graylog employee here. From what you're saying, it sounds like you've not enabled a GELF input on your Graylog instance. I'd recommend reading through our Docker installation docs here: https://docs.graylog.org/en/3.3/pages/installation/docker.html#how-to-get-log-data-in

I'll note that while the input in the example is for Raw/Plaintext, if you create a GELF TCP input using the instructions in that portion of the docs, then you should start seeing your logs show in the UI.