So I played with graylog today, and thoguht it’d be nice to have openhab going in there.
I’ve found a couple of threads and have now managed to get both my events log and openhab log going to graylog. I put in a couple of streams and it can now split them back out again…not bad.
So ignoring the times, these are about the same messages, We can tell the ones from the shelly binding as they appear under bundle name and id.
But on script entries, we have the data in the square brackets with the name of the Script, eg the UPSCheckRule that I run.
Does anyone know how I might get that script name to be passed to syslog/graylog?
The logging config:
# Root logger log4j2.rootLogger.level = WARN log4j2.rootLogger.appenderRefs = out, osgi, syslog log4j2.rootLogger.appenderRef.out.ref = LOGFILE log4j2.rootLogger.appenderRef.osgi.ref = OSGI log4j2.rootLogger.appenderRef.syslog.ref = SYSLOG
log4j2.appender.syslog.type = Syslog log4j2.appender.syslog.name = SYSLOG log4j2.appender.syslog.appName = OpenHAB log4j2.appender.syslog.port = 514 log4j2.appender.syslog.host = graylog log4j2.appender.syslog.protocol = UDP log4J2.appender.syslog.facility=local0 log4j2.appender.syslog.Header=true log4j2.appender.syslog.format = RFC5424
I was able to switch it to a patterned format, but that seems to bust all the bundle id etc. How does the RFC5424 format know about bundle.id and bundle.name? and would be possible to get a bundle.script or something?
Here’s a raw tcpdump:
5:58:34.010003 IP (tos 0x0, ttl 63, id 46621, offset 0, flags [DF], proto UDP (17), length 351) 192.168.10.27.53894 > 172.26.0.2.514: SYSLOG, length: 323 Facility local0 (16), Severity info (6) Msg: 1 2021-04-21T15:58:34.007+12:00 melkor OpenHAB 22 - [mdc@18060 bundle.id="149" bundle.name="org.openhab.core.io.monitor" bundle.version="2.5.0"] logreader:reader:openhablog:newWarningEvent triggered 2021-04-21 15:58:33.311 [WARN ] [e.model.script.DP-DAY-CentralHeating] - (3.1) Keeping the heating in the current state
Any way we can fiddle with those mdc values bundle.name etc? and add a new one?