Logstash GELF appender not sending logs to Graylog

Graylog Central (peer support)
1

I am trying to send logs of my spring boot app to ovh LDP graylog for a specefic stream with the write token. in my build.gradle i add the dependecy :

implementation('net.logstash.logback:logstash-logback-encoder:8.0')

my logback-spring.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration scan="true" scanPeriod="10 seconds" debug="true">
<springProfile name="local">
        <appender name="JSON_FILE" class="ch.qos.logback.core.FileAppender">
            <file>logs/test-log.json</file>
            <append>true</append>
            <encoder class="net.logstash.logback.encoder.LogstashEncoder">
                <fieldNames>
                    <message>short_message</message>
                    <level>Niveau</level>
                    <timestamp>-</timestamp>
                    <mdc>mdc</mdc>
                </fieldNames>
                <provider class="ovh.sas.server.logs.LevelToIntegerJsonConverter"/>
                <provider class="ovh.sas.server.logs.UnixTimestampProvider"/>
                <customFields>{"host":"myLocalhost", "_X-OVH-TOKEN":"myToken"}</customFields>
            </encoder>
        </appender>
        <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
            <encoder>
                <pattern>${LOG_CONSOLE} - %msg%n%rEx{full,${LOG_STACK}}</pattern>
            </encoder>
        </appender>

        <appender name="GELF" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
            <destination>gra159.logs.ovh.com:12202</destination>
            <ssl>false</ssl>
            <encoder class="net.logstash.logback.encoder.LogstashEncoder">
                <fieldNames>
                    <message>short_message</message>
                    <level>Niveau</level>
                    <timestamp>-</timestamp>
                    <mdc>mdc</mdc>
                </fieldNames>
                <provider class="ovh.sas.server.logs.LevelToIntegerJsonConverter"/>
                <provider class="ovh.sas.server.logs.UnixTimestampProvider"/>
                <customFields>{"host":"myLocalhost", "_X-OVH-TOKEN":"myToken", "_X-OVH-INPUT":"gelf"}</customFields>
            </encoder>
            <reconnectionDelay>10000</reconnectionDelay> 
        </appender>
        <root level="INFO">
            <appender-ref ref="CONSOLE"/>
            <appender-ref ref="GELF"/>
            <appender-ref ref="JSON_FILE"/>
        </root>
        <logger name="net.logstash.logback" level="debug">
            <appender-ref ref="GELF"/>
        </logger>
    </springProfile>
    <springProfile name="dev">...</springProfile>

    <springProfile name="cloud">...</springProfile>

    <springProfile name="prod">...</springProfile>
</configuration>

I added the JSON_FILE appender to see the generated message format :

{"-":"2025-03-10T14:28:21.519770619+01:00","@version":"1","short_message":"Retrieving access in batch","logger_name":"sas.server.quartz.device.DeviceAccessMoxaStatusJob","thread_name":"sas-access_Worker-1","Niveau":"INFO","level_value":20000,"mdc":{"USER":"Batch","REQUEST_ID":"2ad999c1-a589-4082-bgd9-64cb1bf87e95"},"level":1,"timestamp":1.74161330152E9,"host":"myLocalhost","_X-OVH-TOKEN":"myToken"}

But nothing in Graylog, and i tryied to send it in java with the same message generated in the json :

public static void main(String[] args) {
    new SpringApplicationBuilder().bannerMode(Mode.LOG).sources(Server.class).run();


    String message = "{\"-\":\"2025-03-10T14:28:21.519770619+01:00\",\"@version\":\"1\",\"short_message\":\"Test message from java\",\"logger_name\":\"sas.server.quartz.device.DeviceAccessMoxaStatusJob\",\"thread_name\":\"sas-access_Worker-1\",\"Niveau\":\"INFO\",\"level_value\":20000,\"mdc\":{\"USER\":\"Batch\",\"REQUEST_ID\":\"2ad999c1-a589-4082-bgd9-64cb1bfa9e95\"},\"level\":1,\"timestamp\":1.74161330152E9,\"host\":\"myLocalhost\",\"_X-OVH-TOKEN\":\"myToken\"}\n";

    SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();
    try (Socket socket = factory.createSocket("gra159.logs.ovh.com", 12202);
         OutputStream outputStream = socket.getOutputStream()) {
        outputStream.write(message.getBytes());
        outputStream.flush();
        System.out.println("✅ Log envoyé manuellement !");
    } catch (UnknownHostException e) {
        throw new RuntimeException(e);
    } catch (IOException e) {
        throw new RuntimeException(e);
    }
}

I receive the log and see it in Graylog stream.

From the terminal also it works :

echo -e '{"-":"2025-03-10T14:28:21.519770619+01:00","@version":"1","short_message":"Retrieving access moxa statuses in batch","logger_name":"sas.server.quartz.device.DeviceAccessMoxaStatusJob","thread_name":"sas-access_Worker-1","Niveau":"INFO","level_value":20000,"mdc":{"USER":"Batch","REQUEST_ID":"2ad999c1-a589-4082-aad9-64cb1bfa9e95"},"level":1,"timestamp":1.74161330152E9,"host":"myLocalhost","_X-OVH-TOKEN":"myToken"}' | openssl s_client -quiet -no_ign_eof -connect gra159.logs.ovh.com:12202

Can you help me to find where is the problem in my case please ?

I don’t have the acces to the server logs (ovh LDAP service)

Thank you.

2

Hey @madiskou

What type of input are you using to ingest logs?