I am trying to use Splunk to collect logs for my app. I set up TCP data input on port 6514 (with SSL enabled on this port). From my Java application, I am able to connect to the port and send logs. However, when I check these logs on Splunk web, it displays as Hex format.
LOGBACK CONFIGURATION
<configuration debug="true">
<appender name="console" class="ch.qos.logback.core.ConsoleAppender">
<encoder>
<pattern>%date{ISO8601} [%thread] [%cyan(%C.%M\(\))] [%highlight(%level)] : %msg - %ex{short} %n</pattern>
</encoder>
</appender>
<appender name="sslsocket" class="ch.qos.logback.classic.net.SSLSocketAppender">
<remoteHost>127.0.0.1</remoteHost>
<port>6514</port>
<queueSize>20</queueSize>
<reconnectionDelay>20</reconnectionDelay>
<ssl>
<trustStore>
<location>file:///path/to/truststore.jks</location>
<password>truststorepassword</password>
</trustStore>
</ssl>
</appender>
<logger name="splunk.secure.logger" additivity="false" level="INFO">
<appender-ref ref="sslsocket"/>
</logger>
<root level="DEBUG">
<appender-ref ref="console" />
</root>
</configuration>
USAGE
public class Starter {
private final static org.slf4j.Logger logger = LoggerFactory.getLogger("splunk.secure.logger");
public static void main(String[] args) {
logger.info("Testing SSL Socket Appender Log");
}
}
LOG BACK DEBUG OUTPUT TO CONSOLE
11:00:04,701 |-INFO in ch.qos.logback.core.joran.action.AppenderAction -
About to instantiate appender of type
[ch.qos.logback.classic.net.SSLSocketAppender]
11:00:04,720 |-INFO in ch.qos.logback.core.joran.action.AppenderAction -
Naming appender as [sslsocket]
11:00:04,763 |-INFO in
ch.qos.logback.core.joran.action.NestedComplexPropertyIA - Assuming default type
[ch.qos.logback.core.net.ssl.SSLConfiguration] for [ssl] property
11:00:04,776 |-INFO in ch.qos.logback.core.joran.action.NestedComplexPropertyIA - Assuming default type [ch.qos.logback.core.net.ssl.KeyStoreFactoryBean] for
[trustStore] property
11:00:06,035 |-INFO in ch.qos.logback.classic.net.SSLSocketAppender[sslsocket] - SSL protocol 'SSL' provider 'SunJSSE version 1.8'
11:00:06,045 |-INFO in ch.qos.logback.classic.net.SSLSocketAppender[sslsocket] - trust store of type 'JKS' provider 'SUN version 1.8': file:///path/to/truststore.jks
11:00:06,046 |-INFO in ch.qos.logback.classic.net.SSLSocketAppender[sslsocket] - trust manager algorithm 'PKIX' provider 'SunJSSE version 1.8'
11:00:06,063 |-INFO in ch.qos.logback.classic.net.SSLSocketAppender[sslsocket] - secure random algorithm 'SHA1PRNG' provider 'SUN version 1.8'
11:00:06,556 |-INFO in ch.qos.logback.classic.joran.action.LoggerAction - Setting level of logger [splunk.secure.logger] to INFO
11:00:06,557 |-INFO in ch.qos.logback.classic.joran.action.LoggerAction - Setting additivity of logger [splunk.secure.logger] to false
11:00:06,564 |-INFO in ch.qos.logback.core.joran.action.AppenderRefAction -
Attaching appender named [sslsocket] to Logger[splunk.secure.logger]
WHAT IS RECEIVED BY SPLUNK WEB
Time Event
3/2/19
9:48:45.000 AM
\xAC\xED\x00
host = 127.0.0.1 source = tcp:6514 sourcetype = logback
In Summary
From the above, it appears to me that this is not a connection issue, as Splunk is listening to the port 6514 and is able to capture input BUT the captured input is displayed as HEX and not normally.
When I use a normal com.splunk.logging.TcpAppender, my logs are displayed correctly on splunk.
I had to switch to log4j in order to solve this. With the below configuration in log4j, the logs were displayed correctly on splunk web.
<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="info" name="example" packages="">
<Appenders>
<Socket name="ssl" host="localhost" port="6514">
<PatternLayout charset="UTF-8">
<pattern>%date{ISO8601} [%thread] [%C.%M\(\) - Line %L] [%level] : %msg %ex{short} %n</pattern>
</PatternLayout>
<JsonLayout properties="true"/>
<SSL>
<TrustStore location="/path/to/keystore.jks" password="password"/>
</SSL>
</Socket>
</Appenders>
<Loggers>
<Root level="INFO">
</Root>
<Logger name="splunk.secure.logger" level="info">
<AppenderRef ref="ssl"/>
</Logger>
</Loggers>
</Configuration>