Logback.groovy LogstashEncoder changing field names

Question

I have logback.groovy that sends data to logstash on the network with some custom fields:

appender("LOGSTASH", LogstashTcpSocketAppender) { encoder(LogstashEncoder) { customFields = """{ "token": "xxxxx", "environment":"dev", "some_property":"foobar" }""" } remoteHost = "logstashlistener.host.name" port = 5000 } 

So far so good. However, I need to clear some field names that are not valid for elasticsearch downstream. Based on the LogstashEncoder documentation, this can be achieved as follows:

 <encoder class="net.logstash.logback.encoder.LogstashEncoder"> <fieldNames> <timestamp>time</timestamp> <message>msg</message> ... </fieldNames> </encoder> 

This seems wonderful, but I have to put this in the logback.groovy notation. I tried as hashmap, string and more, but always ended with Cannot cast object 'xxxx' with class 'xxxx' to class 'net.logstash.logback.fieldnames.LogstashFieldNames'

Answer 1

Try the following. You may also need to add some import for FieldNames and LifeCycle

 appender("LOGSTASH", LogstashTcpSocketAppender) { encoder(LogstashEncoder) { customFields = """{ "token": "xxxxx", "environment":"dev", "some_property":"foobar" }""" FieldNames... aFieldNames = new FieldNames() aFieldNames.timestamp = "time" aFieldNames.message = "msg" if(aFieldNames instanceof LifeCycle) aFieldNames.start() fieldNames = aFieldNames } remoteHost = "logstashlistener.host.name" port = 5000 } 

You can use the following helper page on the journal website to convert the XML configuration to Groovy.

http://logback.qos.ch/translator/asGroovy.html

Answer 2

I needed to do something similar, although I used the LoggingEventCompositeJsonEncoder encoder.

The approach I was supposed to use was to break through the logstash-logback-encoder code to develop real classes. Fortunately, the IntelliJ decompiler makes this not too painful.

If you look at LogstashEncoder, it has a public void setFieldNames(LogstashFieldNames fieldNames) - so you need an instance of LogstashFieldNames

LogstashFieldNames, in turn, has setters for setTimestamp , and the rest, so in groovy your syntax should be:

  encoder(LogstashEncoder) { fieldNames(LogstashFieldNames) { timestamp = "time" message = "msg" } }