如何使用 log4j2 將 JSON 結構作為源而不是消息記錄到彈性搜索中

Question

我的 log4j2.xml 如下，

<Configuration status="info">
  <Properties>
    <Property name="basePath">./</Property>
  </Properties>

  <Appenders>

    <Console name="console" target="SYSTEM_OUT">
      <PatternLayout pattern="[%-5level] %d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %c{1} - %msg%n"/>
    </Console>

    <Http name="ES" url="http://localhost:9200/test/log4j/">
      <JSONLayout complete="false" compact="true" eventEol="true" objectMessageAsJsonObject="true" />
    </Http>
  </Appenders>

  <Loggers>
    <Logger name="io.github.sylllys" level="info" additivity="true">
      <appender-ref ref="ES" level="info"/>
    </Logger>
    <Root level="info" additivity="false">
      <appender-ref ref="console"/>
    </Root>
  </Loggers>
</Configuration>

當我記錄一些 json 負載時，它被存儲在消息元組下，當我嘗試使用 API 獲取彈性結果時，我得到以下響應，查看元組： hits.hits[0]._source.message ，這就是我的 json已從我的 Java 程序登錄，

  "took": 87,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 54,
      "relation": "eq"
    },
    "max_score": 1.0,
    "hits": [
      {
        "_index": "test",
        "_type": "log4j",
        "_id": "2KYwiXwBpgzgsgok5uIw",
        "_score": 1.0,
        "_source": {
          "instant": {
            "epochSecond": 1634389248,
            "nanoOfSecond": 549000000
          },
          "thread": "main",
          "level": "INFO",
          "loggerName": "io.github.sylllys.test.suite.stepDefinitions.Log4JStepDefinitions",
          "message": {
             "test_exec_id": "smoke3",
             "test_suite_id": "suite1",
             "test_case_id": "case1",
             "test_object": "xyz request",
             "assertion_objective": "validation for xyz1 format",
             "assertion_status": "false"
          },
          "endOfBatch": false,
          "loggerFqcn": "org.apache.logging.log4j.spi.AbstractLogger",
          "threadId": 1,
          "threadPriority": 5
        }
      }
    ]
  }
}

我只希望元組hits.hits[0]._source只包含我已記錄的信息，

例子：

{
  "took": 104,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 6,
      "relation": "eq"
    },
    "max_score": 3.2219477,
    "hits": [
      {
        "_index": "test-records",
        "_type": "_doc",
        "_id": "qDkdenwBHlfFxA75kZ_Q",
        "_score": 3.2219477,
        "_source": {
          "assertion_objective": "validation for xyz1 format",
          "assertion_status": "false",
          "test_case_id": "case1",
          "test_suite_id": "suite1",
          "test_object": "xyz request",
          "test_exec_id": "smoke1"
        }
      }
    ]
  }
}

這里也是我用來記錄消息的 Java 代碼，

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.message.ObjectMessage;

    Logger logger = LogManager.getLogger(Log4JStepDefinitions.class);
    TestReportDetails testReportDetails = new TestReportDetails();
    //code to set details into testReportDetails
    logger.info(new ObjectMessage(testReportDetails));

Answer 1

我通過將 log4j2 的 HTTP appender 指向我的自定義服務器解決了這個問題，我在那里編寫了代碼以按照我想要的方式重新格式化 JSON，然后使用彈性 api 來保存它們。