Java 使用Logback SSLSocketAppender时显示为十六进制的Splunk日志
我正在尝试使用Splunk为我的应用程序收集日志。我在端口6514上设置了TCP数据输入(在这个端口上启用了SSL)。通过我的Java应用程序,我能够连接到端口并发送日志。然而,当我在Splunk web上检查这些日志时,它显示为十六进制格式 回登录配置Java 使用Logback SSLSocketAppender时显示为十六进制的Splunk日志,java,ssl,logback,splunk,Java,Ssl,Logback,Splunk,我正在尝试使用Splunk为我的应用程序收集日志。我在端口6514上设置了TCP数据输入(在这个端口上启用了SSL)。通过我的Java应用程序,我能够连接到端口并发送日志。然而,当我在Splunk web上检查这些日志时,它显示为十六进制格式 回登录配置 <configuration debug="true"> <appender name="console" class="ch.qos.logback.core.ConsoleAppender"> <e
<configuration debug="true">
<appender name="console" class="ch.qos.logback.core.ConsoleAppender">
<encoder>
<pattern>%date{ISO8601} [%thread] [%cyan(%C.%M\(\))] [%highlight(%level)] : %msg - %ex{short} %n</pattern>
</encoder>
</appender>
<appender name="sslsocket" class="ch.qos.logback.classic.net.SSLSocketAppender">
<remoteHost>127.0.0.1</remoteHost>
<port>6514</port>
<queueSize>20</queueSize>
<reconnectionDelay>20</reconnectionDelay>
<ssl>
<trustStore>
<location>file:///path/to/truststore.jks</location>
<password>truststorepassword</password>
</trustStore>
</ssl>
</appender>
<logger name="splunk.secure.logger" additivity="false" level="INFO">
<appender-ref ref="sslsocket"/>
</logger>
<root level="DEBUG">
<appender-ref ref="console" />
</root>
</configuration>
将调试输出记录回控制台
11:00:04,701 |-INFO in ch.qos.logback.core.joran.action.AppenderAction -
About to instantiate appender of type
[ch.qos.logback.classic.net.SSLSocketAppender]
11:00:04,720 |-INFO in ch.qos.logback.core.joran.action.AppenderAction -
Naming appender as [sslsocket]
11:00:04,763 |-INFO in
ch.qos.logback.core.joran.action.NestedComplexPropertyIA - Assuming default type
[ch.qos.logback.core.net.ssl.SSLConfiguration] for [ssl] property
11:00:04,776 |-INFO in ch.qos.logback.core.joran.action.NestedComplexPropertyIA - Assuming default type [ch.qos.logback.core.net.ssl.KeyStoreFactoryBean] for
[trustStore] property
11:00:06,035 |-INFO in ch.qos.logback.classic.net.SSLSocketAppender[sslsocket] - SSL protocol 'SSL' provider 'SunJSSE version 1.8'
11:00:06,045 |-INFO in ch.qos.logback.classic.net.SSLSocketAppender[sslsocket] - trust store of type 'JKS' provider 'SUN version 1.8': file:///path/to/truststore.jks
11:00:06,046 |-INFO in ch.qos.logback.classic.net.SSLSocketAppender[sslsocket] - trust manager algorithm 'PKIX' provider 'SunJSSE version 1.8'
11:00:06,063 |-INFO in ch.qos.logback.classic.net.SSLSocketAppender[sslsocket] - secure random algorithm 'SHA1PRNG' provider 'SUN version 1.8'
11:00:06,556 |-INFO in ch.qos.logback.classic.joran.action.LoggerAction - Setting level of logger [splunk.secure.logger] to INFO
11:00:06,557 |-INFO in ch.qos.logback.classic.joran.action.LoggerAction - Setting additivity of logger [splunk.secure.logger] to false
11:00:06,564 |-INFO in ch.qos.logback.core.joran.action.AppenderRefAction -
Attaching appender named [sslsocket] to Logger[splunk.secure.logger]
SPLUNK WEB收到的内容
Time Event
19年3月2日
上午9:48:45.000\xAC\xED\x00 主机=127.0.0.1源=tcp:6514源类型=logback 总之 综上所述,我认为这不是连接问题,因为Splunk正在监听端口6514并能够捕获输入,但捕获的输入显示为十六进制且不正常 当我使用普通的com.splunk.logging.tcpapender时,我的日志会正确显示在splunk上
为了解决这个问题,我不得不切换到log4j。通过log4j中的以下配置,日志在splunk web上正确显示
<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="info" name="example" packages="">
<Appenders>
<Socket name="ssl" host="localhost" port="6514">
<PatternLayout charset="UTF-8">
<pattern>%date{ISO8601} [%thread] [%C.%M\(\) - Line %L] [%level] : %msg %ex{short} %n</pattern>
</PatternLayout>
<JsonLayout properties="true"/>
<SSL>
<TrustStore location="/path/to/keystore.jks" password="password"/>
</SSL>
</Socket>
</Appenders>
<Loggers>
<Root level="INFO">
</Root>
<Logger name="splunk.secure.logger" level="info">
<AppenderRef ref="ssl"/>
</Logger>
</Loggers>
</Configuration>
%日期{ISO8601}[%thread][%C.%M\(\)-行%L][%level]:%msg%ex{short}%n
为了解决这个问题,我不得不切换到log4j。通过log4j中的以下配置,日志在splunk web上正确显示
<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="info" name="example" packages="">
<Appenders>
<Socket name="ssl" host="localhost" port="6514">
<PatternLayout charset="UTF-8">
<pattern>%date{ISO8601} [%thread] [%C.%M\(\) - Line %L] [%level] : %msg %ex{short} %n</pattern>
</PatternLayout>
<JsonLayout properties="true"/>
<SSL>
<TrustStore location="/path/to/keystore.jks" password="password"/>
</SSL>
</Socket>
</Appenders>
<Loggers>
<Root level="INFO">
</Root>
<Logger name="splunk.secure.logger" level="info">
<AppenderRef ref="ssl"/>
</Logger>
</Loggers>
</Configuration>
%日期{ISO8601}[%thread][%C.%M\(\)-行%L][%level]:%msg%ex{short}%n
在$SPLUNK\u HOME/var/log/SPLUNK
的任何日志中的任何相关信息?哦,既然您已经在logback配置中启用了调试,并且没有提及任何内容,我猜那里没有相关的信息输出?那里有很多日志文件。我应该特别检查哪一个?在您的logback配置中,您提供了一个信任库,所以我猜您设置了一个自签名证书。如果加载正确,查看$SPLUNK\u HOME/var/log/SPLUNK/SPLUNK.log
可能会提供一些信息?以下是日志文件:我编辑了这个问题,还将logback调试输出添加到了$SPLUNK\u HOME/var/log/SPLUNK
的任何日志中的控制台相关信息?哦,既然您已经在logback配置中启用了调试,并且没有提及任何内容,我猜那里没有相关的信息输出?那里有很多日志文件。我应该特别检查哪一个?在您的logback配置中,您提供了一个信任库,所以我猜您设置了一个自签名证书。也许查看$SPLUNK\u HOME/var/log/SPLUNK/SPLUNK.log
可以提供一些信息,如果加载正确的话?下面是日志文件:我已经编辑了这个问题,还向控制台添加了logback调试输出