topic Re: Adding splunk logback appender prevents application termination in Splunk Search

Adding splunk logback appender prevents application termination

arash_jalalian — Wed, 06 Sep 2017 01:22:25 GMT

I have the following logback configuration and I am using it in a simple java application that does nothing but logging one line. When I uncomment the splunk appender line it won't let the applicaiton exit, eventhough the application is finished. Is there a way to terminate all the logging threads so let the main application exits?

logback.xml

<appender name="SPLUNK" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
    <url>${splunkUrl}</url>
    <token>${splunkToken}</token>
    <source>${projectName}</source>
    <host>${COMPUTERNAME}</host>
    <sourcetype>batch_application_log:json</sourcetype>
    <disableCertificateValidation>true</disableCertificateValidation>
    <!--<messageFormat>json</messageFormat>-->
    <!--<retries_on_error>1</retries_on_error>-->
    <layout class="ch.qos.logback.classic.PatternLayout">
        <pattern>"%msg"</pattern>
    </layout>
</appender>
<root level="INFO">
     <!--<appender-ref ref="SPLUNK"/>--> if I uncomment this line application never exits
</root>

Here is the java code:

public class Main {

public static void main(String[] args) {
    final Logger logger = LoggerFactory.getLogger(Main.class);
    logger.info("******");
}

}

Re: Adding splunk logback appender prevents application termination

SNaikwade — Thu, 21 Sep 2017 18:33:36 GMT

Any resolution on this?

Re: Adding splunk logback appender prevents application termination

arash_jalalian — Mon, 02 Oct 2017 22:14:51 GMT

I haven't found any solution yet. Had to move on with the Universal Forwarders for now.

Re: Adding splunk logback appender prevents application termination

SNaikwade — Tue, 03 Oct 2017 02:45:20 GMT

Here is the answer to your question.

Re: Adding splunk logback appender prevents application termination

arash_jalalian — Tue, 03 Oct 2017 02:47:12 GMT

I can't see any answer, maybe you forgot to add a link or something.

Re: Adding splunk logback appender prevents application termination

SNaikwade — Tue, 03 Oct 2017 02:47:28 GMT

https://answers.splunk.com/answers/577988/splunk-logging-logback-appenders-is-not-terminatin.html?minQuestionBodyLength=80

Re: Adding splunk logback appender prevents application termination

vijay_iiita — Wed, 21 Feb 2018 22:42:24 GMT

I also tried the same and facing the same issue. Initially I thought application is not getting terminated on getting exception but same is happening without any exception in Hello World Application. Is there any configuration to prevent this?

Re: Adding splunk logback appender prevents application termination

vijay_iiita — Wed, 21 Feb 2018 22:42:50 GMT

Re: Adding splunk logback appender prevents application termination

Anam — Wed, 21 Feb 2018 22:50:16 GMT

Hi vijay_iiita

This question was posted almost 5 months ago. If the comments and the answer weren't able to help you with your question, please post a new question so you can get maximum exposure and help.

Thanks

Re: Adding splunk logback appender prevents application termination

vijay_iiita — Thu, 22 Feb 2018 05:44:28 GMT

Hi asiddique_splunk,

The only answer suggested here is to add custom middleware which check completion of all events. This doesn't seems to be standard solution and more like workaround. Instead I would expect to have exiting behavior as part of Appender configuration if that is intentional. Non existing behavior may be acceptable for web application but might not be suitable for other application which runs on demand like AWS lambda or Spark Job. I am trying to upload logs using Splunk HEC appender for Spark job.

Thanks