How to send weblogic server logs to graylog?

Question

We are sending to applicatios logs to graylog with logback config. I want to send weblogic server logs to graylog. How can i do that?

Thanks

Answer 1

I work with Oracle Commerce on Weblogic, and wanted to investigate using Graylog. I was able to setup a test environment using the Graylog AMIs on AWS EC2. I used the collector-sidecar on a redhat machine running Weblogic 12.1.3.0.0.

If you follow the directions here: http://docs.graylog.org/en/2.2/pages/collector_sidecar.html it is really pretty simple to do. It took me about two hours total (about 1 hour of which I spent trying to figure out why the servers couldn't talk on port 5400 - my EC2 security profile wasn't setup with that port open - duh).

The things I found a bit confusing were in the terminology, input and output... these are in terms of the collector-sidecar, NOT the Graylog server, nor the Beats backend (I used filebeat specifically over NXlog). So an input would be data coming INTO the collector-sidecar from your log file (and I just pointed it to the instance.out file from weblogic), and an output would be going from collector-sidecar TO your Graylog server.

Answer 2

I would suggest you to go through this article which explains various ways for sending logs to graylog server. For weblogic, you would probably need to use collector sidecar to collect data and filebeat/nxlog in the client to send the logs to the graylog server. You can refer the mysql slow query log configuration in that article to get an idea.

You should also create grok patterns to create fields from the incoming log file. You can refer this site to get an idea on what grok pattern is needed for weblogic logs. Consider creating the grok patterns in the graylog web interface and then applying the same as part of extractors in the specific input