Monolog stash log formatting

4.1k views Asked by At

I'm looking to write my log in correct json way to be able to parse it in logstash.

Here is my monolog setup in config.yml:

monolog:
    channels: ["event"]
    handlers:
...
        eventlog:
            type: stream
            path: %kernel.logs_dir%/event.log
            level: info
            channels: ["event"]
            formatter: monolog.formatter.logstash

Service definition:

<service id="monolog.formatter.logstash" class="Monolog\Formatter\LogstashFormatter">
            <argument>"%%datetime%% %%channel%%.%%level_name%% %%message%%"</argument>
</service>

Event Logging:

$eventLog = array(
    "userID" => $user->getId(),
    "eventName" => $eventName,
    "eventDetail" => "detail of log event"
);

$this->container->get('monolog.logger.event')->info(json_encode($eventLog));

event.log content:

{"@timestamp":"2015-06-15T11:02:27.058564+02:00","@source":"MacBook-Pro-de-Peter.local","@fields":{"channel":"event","level":200},"@message":"{\"userID\":278,\"eventName\":\"facebookLogin\",\"eventDetail\":\"multiPageFbk \"}","@tags":["event"],"@type":"\"%datetime% %channel%.%level_name% %message%\""}

Unfortunately, my @message is a string, not a json. Any ideas how to obtain a regular json? Moreover, how to complete @type field with correct value?

1

There are 1 answers

0
peter On

I found finally the answer..

input {
    file {
       codec => "json"
       path => "/Users/Project/app/logs/event.log"
       start_position => "beginning"
    }
}

filter {
    json {
        source => "message"
    }
    json {
        source => "@message"
        target => "event_detail"
    }
}