magic bug，one line json become mutiple message

[vy]

magic bug，one line json become mutiple message

[vy]

You need to disable pretty-print, that is, prettyPrintEnabled=false. Would you mind confirming if that fixes your issue, please?

[a1046149428]

Thanks for your reply, this problem has been solved, but this seems to be more complicated than the JsonLayout that comes with log4j2. Do you have any suggestions for this?

[vy]

@a1046149428, I am having a hard time to follow you. Would you mind first describing what are you trying to achieve, please? What is your setup? Are you trying to pipe LogstashLayout-generated JSONs to Logstash with a SocketAppender? I would appreciate if you can provide a minimal setup that I can reproduce your problem and work on a solution.

[a1046149428]

Thank you for your attention, the configuration I used is temporarily unavailable because it is at home. But the format I want is as shown below. I hope that this layout can provide information about the actual content of the application, rather than the json with many layers as shown above.

[vy]

@a1046149428 I can't help unless I know the setup. Please do provide a simple setup that I can reproduce the problem myself. Sharing a Kibana screenshot does not help really.

[a1046149428]

Thank you for your patience, this is my steps：
the setup

[vy]

Ok, this is strange. I am not able reproduce the error. I started Logstash 7.2.0 with the following configuration as described in the documentation:

input {
  tcp {
    port => 3456
    codec => json
  }
}

filter {
  date {
    match => [ "timeMillis", "UNIX_MS" ]
  }
}

output {
  stdout {}
}

Opened log42j-logstash-layout project in my IDE and changed layout-demo/src/main/resources/log4j2.xml as follows:

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="warn">
    <Appenders>
        <Socket name="LOGSTASH" host="localhost" port="3456" protocol="TCP">
            <LogstashLayout dateTimeFormatPattern="yyyy-MM-dd'T'HH:mm:ss.SSSZZZ"
                            eventTemplateUri="classpath:LogstashJsonEventLayoutV1.json"
                            prettyPrintEnabled="false"
                            stackTraceEnabled="true"/>
        </Socket>
    </Appenders>
    <Loggers>
        <Root level="info">
            <AppenderRef ref="LOGSTASH"/>
        </Root>
    </Loggers>
</Configuration>

Added a Thread.sleep(1_000L); line to the bottom of LogstashLayoutDemo.java (to give the SocketAppender sufficient time to flush) and started main(). Following is what I appeared in my console running Logstash:

{
    "thread_name" => "main",
    "logger_name" => "com.vlkan.log4j2.logstash.layout.demo.LogstashLayoutDemo",
           "host" => "172.17.0.1",
       "@version" => 1,
        "message" => "Hello, world!",
     "@timestamp" => 2019-07-06T20:33:24.910Z,
           "port" => 46894,
    "source_host" => "tahta",
          "level" => "INFO"
}
{   
    "thread_name" => "main",
    "logger_name" => "com.vlkan.log4j2.logstash.layout.demo.LogstashLayoutDemo",
           "host" => "172.17.0.1",
       "@version" => 1,
        "message" => "Hello, error!",
     "@timestamp" => 2019-07-06T20:33:24.931Z,
           "port" => 46894,
      "exception" => {
               "stacktrace" => "java.lang.RuntimeException: test\n\tat com.vlkan.log4j2.logstash.layout.demo.LogstashLayoutDemo.main(LogstashLayoutDemo.java:11)\n",
          "exception_class" => "java.lang.RuntimeException",
        "exception_message" => "test"
    },
    "source_host" => "tahta",
          "level" => "ERROR"
}

Did you configure your Logstash properly? Would you mind comparing your setup with mine, please?

[a1046149428]

Sorry, I can't reproduce this problem either.
The computer that had problems at the time was my company.
I remember that I was reviving this problem at home, but I couldn't find similar data in elastic search, maybe it was covered or deleted by me.
But I am sure there is no problem with my logstash configuration.
Maybe it is caused by other environmental variables.
By the way, what I am at home is filebeat, maybe this is not the same?

Filebeat.inputs:
- type: tcp
   Max_message_size: 10MiB
   Host: "0.0.0.0:9000"

Output.elasticsearch:
   # Array of hosts to connect to.
   Hosts: ["172.17.0.6:9200"]

Anyway I will close this issue, which does not involve the log42 layout.
Last but not least, I am glad that my problem has been solved, thank you very much for your help.