Search code examples
c++logginglogstashlog4cplus

C++ : How to use SocketAppender of log4cplus to send logs to logstash server?


I'm trying to send logs of my C++ application to logstash using log4cplus library. I have read the log4cplus documentation and used below configurations to configure SocketAppender.

log4cplus.rootLogger=INFO, SA
log4cplus.appender.SA=log4cplus::SocketAppender
log4cplus.appender.SA.port=5044  
log4cplus.appender.SA.host=127.0.0.1  
log4cplus.appender.SA.serverName=MyServer
log4cplus.appender.SA.layout=log4cplus::PatternLayout
log4cplus.appender.SA.layout.ConversionPattern=%m%n

In the code i have initialized the logger and tried to send the message to the logger.

PropertyConfigurator config(configFile);
config.configure();
std::string msg = "test msg";
Logger root = Logger::getRoot();
LOG4CPLUS_INFO(root,msg);

But i was not getting the expected message on logstash server. I was getting some garbage data as shown below.

{ "@version" => "1", "host" => "localhost", "message" => "\u0000\u0000\u0000q\u0003\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004root\u0000\u0000N \u0000\u0000\u0000\u0000\u0000\u0000\u0000\btest msg\u0000\u0000\u0000\u000F140382836238144Z{\u0014N\u0000\u0004\u0003\xC0\u0000\u0000\u0000\u0013../src/property.cpp\u0000\u0000\u00002\u0000\u0000\u0000\u0015int main(int, char**)", "@timestamp" => 2018-02-07T14:59:26.284Z, "port" => 47148 }

I have read the documentation of log4cplus and tried several configuration changes and nothing worked. I could send the log to logstash server using netcat command. So atleast im sure that my logstash configurations are correct. I have configured the logstash with below conf file.

input {
  tcp {
    port => 5044
  }
}

filter{
}

output {
  stdout {
    codec => rubydebug
  }
}

Can anyone tell me what i'm doing wrong with log4cplus ? Is it possible to use log4cplus for sending logs to logstash server ?


Solution

  • log4cplus::SocketAppender is specific to Log4cplus. If you want to log into Logstash, you will have to create your own appender to do that.