Monolog stash log formatting

Question

I'm looking to write my log in correct json way to be able to parse it in logstash.

Here is my monolog setup in config.yml:

monolog:
    channels: ["event"]
    handlers:
...
        eventlog:
            type: stream
            path: %kernel.logs_dir%/event.log
            level: info
            channels: ["event"]
            formatter: monolog.formatter.logstash

Service definition:

<service id="monolog.formatter.logstash" class="Monolog\Formatter\LogstashFormatter">
            <argument>"%%datetime%% %%channel%%.%%level_name%% %%message%%"</argument>
</service>

Event Logging:

$eventLog = array(
    "userID" => $user->getId(),
    "eventName" => $eventName,
    "eventDetail" => "detail of log event"
);

$this->container->get('monolog.logger.event')->info(json_encode($eventLog));

event.log content:

{"@timestamp":"2015-06-15T11:02:27.058564+02:00","@source":"MacBook-Pro-de-Peter.local","@fields":{"channel":"event","level":200},"@message":"{\"userID\":278,\"eventName\":\"facebookLogin\",\"eventDetail\":\"multiPageFbk \"}","@tags":["event"],"@type":"\"%datetime% %channel%.%level_name% %message%\""}

Unfortunately, my @message is a string, not a json. Any ideas how to obtain a regular json? Moreover, how to complete @type field with correct value?

You need to setup `json` input filter within `logstash`: https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html. Unfortunately, I cannot give you a precise example since I am away from my dev box, but I will add it as soon I am. — Jovan Perovic, Jun 15 '15 at 09:29
Yes, I will need to parse json (escaped) values in json formatted attribute @message. Any ideas? — peter, Jun 16 '15 at 08:17

score 4 · Answer 1 · answered Jun 16 '15 at 08:56

I found finally the answer..

input {
    file {
       codec => "json"
       path => "/Users/Project/app/logs/event.log"
       start_position => "beginning"
    }
}

filter {
    json {
        source => "message"
    }
    json {
        source => "@message"
        target => "event_detail"
    }
}

Monolog stash log formatting

1 Answers1