Question

我希望以正确的json方式编写我的日志，以便能够在logstash中解析它。

这是我在config.yml中的monolog设置：

monolog:
    channels: ["event"]
    handlers:
...
        eventlog:
            type: stream
            path: %kernel.logs_dir%/event.log
            level: info
            channels: ["event"]
            formatter: monolog.formatter.logstash

服务定义：

<service id="monolog.formatter.logstash" class="Monolog\Formatter\LogstashFormatter">
            <argument>"%%datetime%% %%channel%%.%%level_name%% %%message%%"</argument>
</service>

事件记录：

$eventLog = array(
    "userID" => $user->getId(),
    "eventName" => $eventName,
    "eventDetail" => "detail of log event"
);

$this->container->get('monolog.logger.event')->info(json_encode($eventLog));

event.log内容：

{"@timestamp":"2015-06-15T11:02:27.058564+02:00","@source":"MacBook-Pro-de-Peter.local","@fields":{"channel":"event","level":200},"@message":"{\"userID\":278,\"eventName\":\"facebookLogin\",\"eventDetail\":\"multiPageFbk \"}","@tags":["event"],"@type":"\"%datetime% %channel%.%level_name% %message%\""}

不幸的是，我的@message是一个字符串，而不是json。任何想法如何获得一个普通的json？而且，如何用正确的值完成@type字段？

Answer 1

我终于找到了答案..

input {
    file {
       codec => "json"
       path => "/Users/Project/app/logs/event.log"
       start_position => "beginning"
    }
}

filter {
    json {
        source => "message"
    }
    json {
        source => "@message"
        target => "event_detail"
    }
}

Monolog藏匿日志格式

1 个答案: