Jboss wildfly logs to graylog stack (using opensearch)

[devender]

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
currently am using jamezp/jboss-logmanager-ext: Extended support for JBoss Log Manager (github.com) jboss-logmanager-ext to send wildfly log to ELK stack. But we are now being asked to use Graylog for the same (using opensearch).

Am able to ship wildfly server.log to ELK stack using above jar (jboss-logmanager-ext) and able to see in kibana.

I do have my Graylog (v5) stack running but i dont know how to send the wildfly log that is currently being shipped to ELK to our Graylog stack.

2. Describe your environment:

• OS Information:
  Linux (RHEL 8)

• Package Version:
  graylog v5.2 followed steps as per graylog site.

• Service logs, configurations, and environment variables:
  using wildfly server.log to be shipped by using steps given in URL for wildfly (in URL shared above)

3. What steps have you already taken to try and solve the problem?
Graylog stack v5.2 is up running with opensearch and mongodb. But now i want to ship wildfly log to graylog. Currently wildflyl logs are being shipped to ELK stack.

4. How can the community help?
Please advise and share the guidelines/pointer/steps that i can use to ship wildfly logs to graylog stack.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

[gsmith]

Hey @devender

Choose filebeat for that If you want to send direct, try to adopt GELF. It been a while since I played with wildflyl logs.

[devender]

@gsmith

try to adopt G

Thank you, @gsmith. I installed the logstash-gelf on wildfly for getting output in GELF format. [GitHub - mp911de/logstash-gelf: Graylog Extended Log Format (GELF) implementation in Java for all major logging frameworks: log4j, log4j2, java.util.logging, logback, JBossAS7 and WildFly 8-12].

Though module is added in subsystem but having error for some FILE:

[standalone@172.16.0.7:9990 /] /subsystem=logging/custom-handler=GelfLogger/:add(module=biz.paluch.logging,class=biz.paluch.logging.gelf.wildfly.WildFlyGelfLogHandler,properties={ \

   host="udp:172.16.0.18", \
   port="12201", \
   version="1.0", \

facility=“logstash-gelf”,
extractStackTrace=true,
filterStackTrace=true,
includeLogMessageParameters=true,
mdcProfiling=true,
timestampPattern=“yyyy-MM-dd HH:mm:ss,SSS”,
maximumMessageSize=8192,
additionalFields=“fieldName1=fieldValue1,fieldName2=fieldValue2”,
additionalFieldTypes=“fieldName1=String,fieldName2=Double,fieldName3=Long”,
mdcFields=“mdcField1,mdcField2”
dynamicMdcFields=“mdc.,(mdc|MDC)fields"
dynamicMdcFieldTypes="my_field.=String,business..*.field=double”
includeFullMdc=true
})
{“outcome” => “success”}

[standalone@172.16.0.7:9990 /] /subsystem=logging/root-logger=ROOT/:write-attribute(name=handlers,value=[“FILE”,“CONSOLE”,“GelfLogger”])
{
“outcome” => “failed”,
“failure-description” => “WFLYCTL0158: Operation handler failed: java.lang.IllegalArgumentException: Handler "FILE" is not found”,
“rolled-back” => true
}

if this issue is fixed - it will be sending the log (GELF formatted) to graylog server (172.16.0.18) listening to udp:12201. I have created one system/input:

Please suggest what could be the reason for above Handler ‘FILE’ problem

thank you
-Devender Singh

[gsmith]

Het @devender

I havent used that software but i took a look and its really old, no maintainers. Not 100% sure put it might have something to do with this…

@devender

handlers,value=[“FILE”,“CONSOLE”,“GelfLogger”])

I did find this post

I can't receive logs in a graylog from java app running in wildfly server

Hi: I have a java application running on a Wilfly 19 server. The server is a Centos centos-release-8.2-2.2004.0.2.el8.x86_64. I installed there a graylog 3.1 from docker-compose with Elastic 6.8.2 and mongo 3. The graylog is running without any trouble. I configured the Wildfly standalone.xml file in order to write in the graylog, but I can’t receive any logs. The docker-compose.yml file is like this: version: '2' services: # MongoDB: https://hub.docker.com/_/mongo/ mongodb: …

And this has some configuration that might help. Other then that Im not sure.

Thorntail (wldfly swarm) logging to Greylog

[devender]

Actually am doing the same - placed the required jar(s) in the modules path. added that module jars to standalone.xml subsystem using jboss-cli commands - outcome was success. But am still not able to understand the cause of error when i tried to add root-logger via command:

[standalone@172.16.0.7:9990 /] /subsystem=logging/root-logger=ROOT/:write-attribute(name=handlers,value=[“FILE”,“CONSOLE”,“GelfLogger”])
{
“outcome” => “failed”,
“failure-description” => “WFLYCTL0158: Operation handler failed: java.lang.IllegalArgumentException: Handler “FILE” is not found”,
“rolled-back” => true
}

Am able to ingest wildfly v14 log to ELK (Elastic,logstash,kibana) and also to (opensearch,logstash,opensearch dashboard) but not for graylog.

In the URL you have given - person also doing the same but didnt got this exception - instead he was missing to add jar under the module path.

the only difference i found, am using wildfly v14.0 and he is using wildfly v19.0. For some reason product team has not upgraded to higher version of wildfly yet. so trying to check if we can ingest the log of wildfly v14 to graylog.

Thank you
-Devender Singh

[devender]

can I stream standalone.log file from wildfly server to graylog server using filebeat ? note: the wildflylog format of log file is default jboss format not GELF.

[devender]

can anyone share some inputs here ?