Jboss wildfly logs to graylog stack (using opensearch)

Graylog Central (peer support)
1

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
currently am using jamezp/jboss-logmanager-ext: Extended support for JBoss Log Manager (github.com) jboss-logmanager-ext to send wildfly log to ELK stack. But we are now being asked to use Graylog for the same (using opensearch).

Am able to ship wildfly server.log to ELK stack using above jar (jboss-logmanager-ext) and able to see in kibana.

I do have my Graylog (v5) stack running but i dont know how to send the wildfly log that is currently being shipped to ELK to our Graylog stack.

2. Describe your environment:

  • OS Information:
    Linux (RHEL 8)

  • Package Version:
    graylog v5.2 followed steps as per graylog site.

  • Service logs, configurations, and environment variables:
    using wildfly server.log to be shipped by using steps given in URL for wildfly (in URL shared above)

3. What steps have you already taken to try and solve the problem?
Graylog stack v5.2 is up running with opensearch and mongodb. But now i want to ship wildfly log to graylog. Currently wildflyl logs are being shipped to ELK stack.

4. How can the community help?
Please advise and share the guidelines/pointer/steps that i can use to ship wildfly logs to graylog stack.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

Hey @devender

Choose filebeat for that If you want to send direct, try to adopt GELF. It been a while since I played with wildflyl logs.

3

Thank you, @gsmith. I installed the logstash-gelf on wildfly for getting output in GELF format. [GitHub - mp911de/logstash-gelf: Graylog Extended Log Format (GELF) implementation in Java for all major logging frameworks: log4j, log4j2, java.util.logging, logback, JBossAS7 and WildFly 8-12].

Though module is added in subsystem but having error for some FILE:

[standalone@172.16.0.7:9990 /] /subsystem=logging/custom-handler=GelfLogger/:add(module=biz.paluch.logging,class=biz.paluch.logging.gelf.wildfly.WildFlyGelfLogHandler,properties={ \

   host="udp:172.16.0.18", \
   port="12201", \
   version="1.0", \

facility=“logstash-gelf”,
extractStackTrace=true,
filterStackTrace=true,
includeLogMessageParameters=true,
mdcProfiling=true,
timestampPattern=“yyyy-MM-dd HH:mm:ss,SSS”,
maximumMessageSize=8192,
additionalFields=“fieldName1=fieldValue1,fieldName2=fieldValue2”,
additionalFieldTypes=“fieldName1=String,fieldName2=Double,fieldName3=Long”,
mdcFields=“mdcField1,mdcField2”
dynamicMdcFields=“mdc.,(mdc|MDC)fields"
dynamicMdcFieldTypes="my_field.=String,business..*.field=double”
includeFullMdc=true
})
{“outcome” => “success”}

[standalone@172.16.0.7:9990 /] /subsystem=logging/root-logger=ROOT/:write-attribute(name=handlers,value=[“FILE”,“CONSOLE”,“GelfLogger”])
{
“outcome” => “failed”,
“failure-description” => “WFLYCTL0158: Operation handler failed: java.lang.IllegalArgumentException: Handler "FILE" is not found”,
“rolled-back” => true
}

if this issue is fixed - it will be sending the log (GELF formatted) to graylog server (172.16.0.18) listening to udp:12201. I have created one system/input:

image
image860×348 15.3 KB

Please suggest what could be the reason for above Handler ‘FILE’ problem

thank you
-Devender Singh

4

Het @devender

I havent used that software but i took a look and its really old, no maintainers. Not 100% sure put it might have something to do with this…

I did find this post

And this has some configuration that might help. Other then that Im not sure.

5

Actually am doing the same - placed the required jar(s) in the modules path. added that module jars to standalone.xml subsystem using jboss-cli commands - outcome was success. But am still not able to understand the cause of error when i tried to add root-logger via command:

[standalone@172.16.0.7:9990 /] /subsystem=logging/root-logger=ROOT/:write-attribute(name=handlers,value=[“FILE”,“CONSOLE”,“GelfLogger”])
{
“outcome” => “failed”,
“failure-description” => “WFLYCTL0158: Operation handler failed: java.lang.IllegalArgumentException: Handler “FILE” is not found”,
“rolled-back” => true
}

Am able to ingest wildfly v14 log to ELK (Elastic,logstash,kibana) and also to (opensearch,logstash,opensearch dashboard) but not for graylog.

image
image1865×1078 286 KB

In the URL you have given - person also doing the same but didnt got this exception - instead he was missing to add jar under the module path.

the only difference i found, am using wildfly v14.0 and he is using wildfly v19.0. For some reason product team has not upgraded to higher version of wildfly yet. so trying to check if we can ingest the log of wildfly v14 to graylog.

Thank you
-Devender Singh

6

can I stream standalone.log file from wildfly server to graylog server using filebeat ? note: the wildflylog format of log file is default jboss format not GELF.

7

can anyone share some inputs here ?

8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.