How to directly log my java application logs to Splunk Enterprise?

logesh_ssg — Wed, 17 Jun 2020 22:40:47 GMT

I am a newbie, just exploring the features of Enterprise. Wanted to upload my logs directly to Enterprise. May be simple question to you, please help.

I have attached my code and configuration file.
package com.logesh;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

public class Log4j2Demo {
    public static void main(String[] args) {
        final Logger logger = LogManager.getLogger("splunk.log4j");
        logger.info("Entering Log4j Example.");
        logger.info("Performing...");
        logger.info("Exiting Log4j Example.");
        System.out.println("-------");
    }
}

My configuration file. (log4j2.xml)

<?xml version="1.0" encoding="UTF-8"?>

<Configuration status="info" name="example" packages="com.logesh">
        <Appenders>
            <Console name="Console" target="SYSTEM_OUT">
                <PatternLayout pattern="%d{HH:mm:ss.SSS}
                 [%t] %-5level %logger{36} - %msg%n" />
            </Console>
            <Http name="http-input"
              url="http://localhost:8000/services/collector/event/1.0"
              token="MYTOKEN"
              host="MYHOST"
              index="main"
              source="splunktest"
              sourcetype="battlecat"

              middleware="HttpEventCollectorUnitTestMiddleware"
              disableCertificateValidation="true">
            <PatternLayout pattern="%m"/>
            </Http>
       </Appenders>
    <Loggers>
        <Root level="INFO">
        </Root>
           <Logger name="splunk.log4j" level="info">
            <AppenderRef ref="http-input"/>
        </Logger>
    </Loggers>
</Configuration>

When I run this code I get error like:

2018-09-10 13:53:38,082 main ERROR Http contains invalid attributes "disableCertificateValidation", "host", "index", "sourcetype", "source", "middleware", "token"
2018-09-10 13:53:38,260 main ERROR Unable to send HTTP in appender [http-input] java.io.IOException: 303 See Other
    at org.apache.logging.log4j.core.appender.HttpURLConnectionManager.send(HttpURLConnectionManager.java:132)
    at org.apache.logging.log4j.core.appender.HttpAppender.append(HttpAppender.java:170)
    at org.apache.logging.log4j.core.config.AppenderControl.tryCallAppender(AppenderControl.java:156)
    at org.apache.logging.log4j.core.config.AppenderControl.callAppender0(AppenderControl.java:129)
    at org.apache.logging.log4j.core.config.AppenderControl.callAppenderPreventRecursion(AppenderControl.java:120)
    at org.apache.logging.log4j.core.config.AppenderControl.callAppender(AppenderControl.java:84)
    at org.apache.logging.log4j.core.config.LoggerConfig.callAppenders(LoggerConfig.java:464)
    at org.apache.logging.log4j.core.config.LoggerConfig.processLogEvent(LoggerConfig.java:448)
    at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:431)
    at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:406)
    at org.apache.logging.log4j.core.config.AwaitCompletionReliabilityStrategy.log(AwaitCompletionReliabilityStrategy.java:63)
    at org.apache.logging.log4j.core.Logger.logMessage(Logger.java:146)
    at org.apache.logging.log4j.spi.AbstractLogger.tryLogMessage(AbstractLogger.java:2170)
    at org.apache.logging.log4j.spi.AbstractLogger.logMessageTrackRecursion(AbstractLogger.java:2125)
    at org.apache.logging.log4j.spi.AbstractLogger.logMessageSafely(AbstractLogger.java:2108)
    at org.apache.logging.log4j.spi.AbstractLogger.logMessage(AbstractLogger.java:2002)
    at org.apache.logging.log4j.spi.AbstractLogger.logIfEnabled(AbstractLogger.java:1974)
    at org.apache.logging.log4j.spi.AbstractLogger.info(AbstractLogger.java:1311)
    at com.logesh.Log4j2Demo.main(Log4j2Demo.java:9)

2018-09-10 13:53:38,264 main ERROR Unable to send HTTP in appender [http-input] java.io.IOException: 303 See Other
    at org.apache.logging.log4j.core.appender.HttpURLConnectionManager.send(HttpURLConnectionManager.java:132)
    at org.apache.logging.log4j.core.appender.HttpAppender.append(HttpAppender.java:170)
    at org.apache.logging.log4j.core.config.AppenderControl.tryCallAppender(AppenderControl.java:156)
    at org.apache.logging.log4j.core.config.AppenderControl.callAppender0(AppenderControl.java:129)
    at org.apache.logging.log4j.core.config.AppenderControl.callAppenderPreventRecursion(AppenderControl.java:120)
    at org.apache.logging.log4j.core.config.AppenderControl.callAppender(AppenderControl.java:84)
    at org.apache.logging.log4j.core.config.LoggerConfig.callAppenders(LoggerConfig.java:464)
    at org.apache.logging.log4j.core.config.LoggerConfig.processLogEvent(LoggerConfig.java:448)
    at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:431)
    at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:406)
    at org.apache.logging.log4j.core.config.AwaitCompletionReliabilityStrategy.log(AwaitCompletionReliabilityStrategy.java:63)
    at org.apache.logging.log4j.core.Logger.logMessage(Logger.java:146)
    at org.apache.logging.log4j.spi.AbstractLogger.tryLogMessage(AbstractLogger.java:2170)
    at org.apache.logging.log4j.spi.AbstractLogger.logMessageTrackRecursion(AbstractLogger.java:2125)
    at org.apache.logging.log4j.spi.AbstractLogger.logMessageSafely(AbstractLogger.java:2108)
    at org.apache.logging.log4j.spi.AbstractLogger.logMessage(AbstractLogger.java:2002)
    at org.apache.logging.log4j.spi.AbstractLogger.logIfEnabled(AbstractLogger.java:1974)
    at org.apache.logging.log4j.spi.AbstractLogger.info(AbstractLogger.java:1311)
    at com.logesh.Log4j2Demo.main(Log4j2Demo.java:10)

2018-09-10 13:53:38,267 main ERROR Unable to send HTTP in appender [http-input] java.io.IOException: 303 See Other
    at org.apache.logging.log4j.core.appender.HttpURLConnectionManager.send(HttpURLConnectionManager.java:132)
    at org.apache.logging.log4j.core.appender.HttpAppender.append(HttpAppender.java:170)
    at org.apache.logging.log4j.core.config.AppenderControl.tryCallAppender(AppenderControl.java:156)
    at org.apache.logging.log4j.core.config.AppenderControl.callAppender0(AppenderControl.java:129)
    at org.apache.logging.log4j.core.config.AppenderControl.callAppenderPreventRecursion(AppenderControl.java:120)
    at org.apache.logging.log4j.core.config.AppenderControl.callAppender(AppenderControl.java:84)
    at org.apache.logging.log4j.core.config.LoggerConfig.callAppenders(LoggerConfig.java:464)
    at org.apache.logging.log4j.core.config.LoggerConfig.processLogEvent(LoggerConfig.java:448)
    at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:431)
    at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:406)
    at org.apache.logging.log4j.core.config.AwaitCompletionReliabilityStrategy.log(AwaitCompletionReliabilityStrategy.java:63)
    at org.apache.logging.log4j.core.Logger.logMessage(Logger.java:146)
    at org.apache.logging.log4j.spi.AbstractLogger.tryLogMessage(AbstractLogger.java:2170)
    at org.apache.logging.log4j.spi.AbstractLogger.logMessageTrackRecursion(AbstractLogger.java:2125)
    at org.apache.logging.log4j.spi.AbstractLogger.logMessageSafely(AbstractLogger.java:2108)
    at org.apache.logging.log4j.spi.AbstractLogger.logMessage(AbstractLogger.java:2002)
    at org.apache.logging.log4j.spi.AbstractLogger.logIfEnabled(AbstractLogger.java:1974)
    at org.apache.logging.log4j.spi.AbstractLogger.info(AbstractLogger.java:1311)
    at com.logesh.Log4j2Demo.main(Log4j2Demo.java:11)

-------

Please help me to solve this.

Re: How to directly log my java application logs to Splunk Enterprise?

jamessevener — Mon, 19 Aug 2019 15:09:46 GMT

For anyone finding this searching, this was an issue with the appender name. See this issue: https://github.com/splunk/splunk-library-javalogging/issues/97

It's resolved in splunk-library-javalogging release 1.7.0.

topic Re: How to directly log my java application logs to Splunk Enterprise? in Splunk Dev

How to directly log my java application logs to Splunk Enterprise?

Re: How to directly log my java application logs to Splunk Enterprise?