I have an Apache NiFi instance that needs to log messages to a remote Graylog server. I want the outputs to nifi-app.log, nifi-bootstrap.log, and nifi-user.log to all be sent to this server, as well as their default local policy.
I'm trying to get the logs to the server over UDP, as the network configuration requires UDP connections.
My questions:
As far as I know, Logback does not provide an out-of-the-box UDP appender so you would need to add the necessary JARs for some UDP appender, possibly the logstash one:
https://github.com/logstash/logstash-logback-encoder
This might work, but adding JARs to NiFi's lib directory is a bit dangerous as they end up on the classpath of all NiFi processors and could have unintended consequences.
Other options...
1) Use TCP
logback already has an socket appender provided: https://logback.qos.ch/manual/appenders.html#SocketAppender
2) Use a separate NiFi instance that is used to monitor the logs of the first NiFi instance. The flow would be TailFile -> PutUDP, where TailFile points at nifi-app.log of the first NiFi.