topic How do I remove STDOUT prefix from log4j on a server.log file? in Getting Data In

How do I remove STDOUT prefix from log4j on a server.log file?

jefflanier — Tue, 03 May 2016 16:07:29 GMT

I've got a log file that has some log4j entries like this:

2016-05-03 10:32:35,895 INFO  [STDOUT] (http-0.0.0.0-8180-2) 2016-05-03 10:32:35,895 ERROR [com.somewhere.someservice] - Reason : ....

Where I'd like the first part of the line removed so Splunk simply sees the second timestamp ERROR part, but not the initial first timestamp INFO [STDOUT] ...part.

And in the same log file I've got other entries that only have one timestamp, log_level and category part to it like:

2016-05-03 09:05:20,783 INFO  [STDOUT] (main) **** something....

2016-05-03 09:05:20,783 ERROR  [com.somewhere.someservice].....

I know I should probably adjust the log4j configuration in the JBoss webapp, but that's not an option, so I'm looking to fix this server side in the props/transforms file.

Any recommendations or can someone point me in the right direction?

Re: How do I remove STDOUT prefix from log4j on a server.log file?

somesoni2 — Tue, 03 May 2016 17:35:58 GMT

You can use SEDCMD to remove unwanted string from your events. Again, it's recommended that you fix this from source.

http://docs.splunk.com/Documentation/Splunk/6.2.9/Data/Anonymizedatausingconfigurationfiles

Re: How do I remove STDOUT prefix from log4j on a server.log file?

jefflanier — Tue, 03 May 2016 18:51:47 GMT

I'm not sure I understand how anonymizing the first part of the log entry is going to help. I don't want it showing up or getting indexed at all.