log4r-gelf
log4r-gelf copied to clipboard
Log4r vs Logstash
We're using Log4r with Logstash via Gelf. Is there a reason that "we" couldn't support tags? http://logstash.net/docs/1.2.2/inputs/gelf#tags
Depending on how logstash parses it, you may be able to do so right now via log4r's MDC by setting the prefix to and empty string ( https://github.com/wr0ngway/log4r-gelf/blob/master/lib/log4r-gelf/gelf_outputter.rb#L90 )
- type: GelfOutputter
name: gelf
mapped_context_prefix: ''
then in your code
Log4r::MDC.put("tags", ["t1", "t2"])
which would result in a "_tags" key in the gelf message. You may need a logstash filter to strip the underscore.
I tend not to use tags but instead just use MDC with real keys/values since the graylog webui hotlinks custom gelf fields (preceeding underscore).
If this doesn't work, or you'd like something thats less of a hack, feel free to submit a PR.
Although, now that I look at the logstash doc you linked to, I think that tags fields in the logstash config is globally applied to all events received from gelf. Not sure if having a tags field in the event will override its values.
That is what I tried, but it doesn't work for a few reasons. MDC key/pairs are a subset of @fields, for example @fields._pp, due to the underscore which can't be removed. They are also subject to .inspect which would render them in quotes.
Could tags just be added and merged here https://github.com/wr0ngway/log4r-gelf/blob/master/lib/log4r-gelf/gelf_outputter.rb#L25 and https://github.com/wr0ngway/log4r-gelf/blob/master/lib/log4r-gelf/gelf_outputter.rb#L48 (allowing tags to be added to all or individual events)?