topic Not able to send logs from Docker container to Splunk using log4j2 and logback (any) in Getting Data In

Not able to send logs from Docker container to Splunk using log4j2 and logback (any)

kumavine — Tue, 19 Nov 2019 04:37:11 GMT

I am trying to push Springboot application (running in docker container) logs to Splunk using log4j2 and logback. For this setup, I am using SplunkHttp appender of log4j2 and HttpEventCollectorLogbackAppender for logback. But not able to push logs using HTTP Event Collector.

I have done so far-

1- Having HTTP Event Collector token for authorisation.
2- I used curl command in container to verify connection and its working.
3- Having log4j2 and logback both configuration in Springboot application.
4- Injected self signed certificate in /usr/lib/jvm/java/jre/lib/security/cacerts using Dockerfile.
5- Using splunk-library-javalogging-1.7.3 artifact for supporting HTTP Event Collector. I also used artifact 1.6.0/1.6.2.

But I am not getting any success to push logs from running container to Splunk.

Re: Not able to send logs from Docker container to Splunk using log4j2 and logback (any)

DavidHourani — Tue, 19 Nov 2019 10:03:40 GMT

Hi @kumavine, what kind of errors are you hitting exactly ? Did you successfully test your connectivity to HEC ?

Re: Not able to send logs from Docker container to Splunk using log4j2 and logback (any)

rgoers — Fri, 22 Nov 2019 20:51:10 GMT

You can use Log4j's SocketAppender. In Splunk's settings create a TCP Data Input and then configure the SocketAppender to point to it.