Send logs to log stash without writing to log files in spring boot

Question

Is there any way to send logs to ELK (log stash) without writing to log files in spring boot using log back configuration

Answer 1

Assuming you just don't want to write to log files (but are still using spring boot and logback), then you can use the TCP or UDP logback appender provided by logstash-logback-encoder to send logs to logstash's tcp or udp input.

Example logback configuration:

<configuration>
  <appender name="logstash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
      <destination>logstash-host:4560</destination>
      <encoder class="net.logstash.logback.encoder.LogstashEncoder" />
  </appender>

  <root level="INFO">
      <appender-ref ref="logstash" />
  </root>
</configuration>

Example logstash configuration:

input {
    tcp {
        port => 4560
        codec => json_lines
    }
}

See the logstash-logback-encoder docs for more appender and encoder options.

Answer 2

You can create a auditDocument kind of thing which will have below parameters and than push it to ELK...

Parameters : Req ID, Req BODY, Res BODY, API Called, Method etc..(as per your requirement)