通过log4j \log4j2传输 json到 flume1.7
方式一:使用avro + flume-ng-log4jappender + 重写appender
log4j.appender.flume=com.log.SubLog4jAppender
message和stackTrace 以及自定字段 hostName----->封装json数据----->
flumeEvent = EventBuilder.withBody(msg, Charset.forName("UTF8"), hdrs);
方式二:使用tcp +logststash-gelf + flume源码SystemLogUtil
logststash-gelf 的\u0000刚好替换掉 flume tcp的 \n (大小可能有其他影响)
方式三:取用logststash-gelf的构造JSON其他同[方式一]相同
[方式二]有重连,[方式一]+[方式三]的重连问题 https://issues.apache.org/jira/browse/FLUME-2186
log4j2
org.apache.logging.log4j.core.layout
public byte[] toByteArray(LogEvent event) {
byte[] bytes = this.getBytes(this.toSerializable(event));
return bytes;
// return bytes.length > this.compressionThreshold?this.compress(bytes):bytes;
}
com.log2.GelfLayout2
<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="WARN" monitorInterval="300" packages="com.log2">
<Appenders>
<Console name="Console" target="SYSTEM_OUT">
<PatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"/>
</Console>
<Flume name="eventLogger" compress="false">
<Agent host="192.168.56.103" port="6666"/>
<GelfLayout2/>
</Flume>
</Appenders>
<Loggers>
<Root level="ERROR">
<AppenderRef ref="eventLogger" />
<AppenderRef ref="Console"/>
</Root>
</Loggers>
</Configuration>