search

wr0ngway / log4r-gelf

A Log4r appender for logging to a gelf sink, e.g. the graylog2 server
MIT License
17 stars 5 forks source link

Log4r vs Logstash #7

Open bendodd opened 10 years ago

bendodd commented 10 years ago

We're using Log4r with Logstash via Gelf. Is there a reason that "we" couldn't support tags? http://logstash.net/docs/1.2.2/inputs/gelf#tags

wr0ngway commented 10 years ago

Depending on how logstash parses it, you may be able to do so right now via log4r's MDC by setting the prefix to and empty string ( https://github.com/wr0ngway/log4r-gelf/blob/master/lib/log4r-gelf/gelf_outputter.rb#L90 )

- type: GelfOutputter
  name: gelf
  mapped_context_prefix: ''

then in your code

Log4r::MDC.put("tags", ["t1", "t2"])

which would result in a "_tags" key in the gelf message. You may need a logstash filter to strip the underscore.

I tend not to use tags but instead just use MDC with real keys/values since the graylog webui hotlinks custom gelf fields (preceeding underscore).

If this doesn't work, or you'd like something thats less of a hack, feel free to submit a PR.

wr0ngway commented 10 years ago

Although, now that I look at the logstash doc you linked to, I think that tags fields in the logstash config is globally applied to all events received from gelf. Not sure if having a tags field in the event will override its values.

bendodd commented 10 years ago

That is what I tried, but it doesn't work for a few reasons. MDC key/pairs are a subset of @fields, for example @fields._pp, due to the underscore which can't be removed. They are also subject to .inspect which would render them in quotes.

Could tags just be added and merged here https://github.com/wr0ngway/log4r-gelf/blob/master/lib/log4r-gelf/gelf_outputter.rb#L25 and https://github.com/wr0ngway/log4r-gelf/blob/master/lib/log4r-gelf/gelf_outputter.rb#L48 (allowing tags to be added to all or individual events)?