wildfly-logstash

Logstash module for Wildfly (http://wildfly.org), using https://github.com/SYNAXON/logstash-util-formatter as formatter. The SocketAppender is based on jboss-logmanager-ext (https://github.com/jamezp/jboss-logmanager-ext). Both deserve credits for the original work. This module has been tested with Wildfly 8 to 26.

Compile the jar file with maven: mvn package

To create a ZIP file containing the module: mvn package -P zip

Unzip the archive created in the target/zip folder at $JBOSS_HOME/modules/system/layers/base.

To create a RPM package containing the module: `mvn package -P rpm

Modify the JBoss configuration in standalone/configuration/standalone.xml by adding a formatter to the logging configuration and reference the formatter in the handler.

/subsystem=logging/custom-formatter=LOGSTASH-PATTERN:add(\
  class=net.logstash.logging.formatter.LogstashUtilFormatter,\
  module=x1.wildfly-logstash)

/subsystem=logging/periodic-rotating-file-handler=LOGSTASH:add(\
  autoflush=true,\ 
  suffix=".yyyy-MM-dd",\ 
  append=true, \
  file={path=logstash.log, relative-to=jboss.server.log.dir})

/subsystem=logging/periodic-rotating-file-handler=LOGSTASH:write-attribute(\
  name=named-formatter,value=LOGSTASH-PATTERN)

/subsystem=logging/root-logger=ROOT:add-handler(name=LOGSTASH)

You can define special tags by setting the system property net.logstash.logging.formatter.LogstashUtilFormatter.tags to a comma-separated list of tags.

In the logstash shipper configuration you have to add a input configuration pointing at the outfile with code json.

input {
  file {
    type => "wildfly"
    path => "/opt/wildfly/standalone/log/logstash.log"
    codec => "json"
  }
}

If logstash is running in a docker container, you need to mount the log file into the container.

If you use filebeat to ship the logfiles it should contain a files section like this

- type: log
  enabled: true
  paths:
    - /opt/wildfly/standalone/log/logstash.log
  ignore_older: 24h
  json.keys_under_root: true
  json.add_error_key: true
  fields:
    type: wildfly

Instead of writing to file, you can also enable direct sending of log messages to logstash. You need to setup a logstash input plugin for TCP with json codec.

input {
  tcp {
    codec => "json"
    port => 9996
  }
}

The logging configuration for Wildfly needs to be adapted with a custom handler, setting the hostname and port to the values needed for your logstash server. The file handler with the JSON output is set as subHandler to the new handler. This handler will be used if server is not available (with a retry every 5 seconds). We wrap everything in an async-handler which will queue up the logging events and pushes them asynchronously. If the transport is blocked or slow this will not cause trouble to the application. The async-handler will be used in the logger configuration.

/subsystem=logging/custom-handler=LOGSTASH-SOCKET:add(level=DEBUG, class=net.logstash.logging.handler.SocketHandler,module=x1.wildfly-logstash,named-formatter=LOGSTASH-PATTERN,properties={protocol=TCP, hostname=logstash, port=9996, subHandler=LOGSTASH})
/subsystem=logging/custom-handler=LOGSTASH-SOCKET:add-handler(LOGSTASH)
/subsystem=logging/async-handler=LOGSTASH-ASYNC:add(queue-length=512, subhandlers=[LOGSTASH-SOCKET])
/subsystem=logging/root-logger=ROOT:add-handler(name=LOGSTASH-ASYNC)