JSON Variants (Log4J) with LogStash
Can you change your log format?
After I change your log format to
{ "logger":"com.myApp.ClassName", "timestamp":"1456976539634", "level":"ERROR", "thread":"pool-3-thread-19", "message":"Danger. There was an error", "throwable":"java.Exception" }{ "logger":"com.myApp.ClassName", "timestamp":"1456976539649", "level":"ERROR", "thread":"pool-3-thread-16", "message":"I cannot go on", "throwable":"java.Exception" }One json log per one line and without the "," at the end of the log, I can use the configuration below to parse the json message to correspond field.
input { file { type => "log4j" path => "/logs/mylogs.log" codec => json }}
Use Logstash's log4j input.
http://logstash.net/docs/1.4.2/inputs/log4j
Should look something like this:
input { log4j { port => xxxx }}This worked for me, good luck!