Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrong time format parsing for log4j2 json objects produced by log4j 2.11.0 #529

Closed
matomer opened this issue Jul 15, 2018 · 1 comment
Closed
Labels
Milestone

Comments

@matomer
Copy link

matomer commented Jul 15, 2018

The actual messages produced by log4j 2.11.0 are of the form:

{
  "thread" : "NGSession 14: 127.0.0.1: compile-server",
  "level" : "ERROR",
  "loggerName" : "LOGGER",
  "message" : "msg",
  "endOfBatch" : false,
  "loggerFqcn" : "org.apache.logging.log4j.spi.AbstractLogger",
  "instant" : {
    "epochSecond" : 1531655721,
    "nanoOfSecond" : 34000000
  },
  "contextMap" : { },
  "threadId" : 76,
  "threadPriority" : 5
}

Note that instead of a "@timestamp" (and mills from epoch) there are epoch seconds and epoch nanos.
But Otros fails to parse it and instead gives the UNIX start date (1970 ...) for every event.

Libraries used:

    compile 'org.apache.logging.log4j:log4j-api:2.11.0'
    compile 'org.apache.logging.log4j:log4j-core:2.11.0'
    compile 'com.fasterxml.jackson.core:jackson-core:2.9.4'
    compile 'com.fasterxml.jackson.core:jackson-databind:2.9.4'
    compile 'com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.9.4'
    compile 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.9.4'

Configuration used:

Configuration:
  Appenders:
    Console:
      name: STDOUT
      JsonLayout:
        properties: true
      
   Loggers:
    Root:
      level: debug
      AppenderRef:
        ref: STDOUT

Simple intellij (scala) scratch to reproduce:

import org.apache.logging.log4j.LogManager

LogManager.getLogger("LOGGER").error("msg")
@matomer matomer changed the title Wrong time format parsing for log4j2 json objects produced by log4j 2.11.0 ('org.apache.logging.log4j:log4j-*:2.11.0') Wrong time format parsing for log4j2 json objects produced by log4j 2.11.0 Jul 15, 2018
@otros-systems
Copy link
Owner

I was using event from Log4j2 doc: https://logging.apache.org/log4j/log4j-2.1/manual/layouts.html

{
    "logger":"com.foo.Bar",
    "timestamp":"1376681196470",
    "level":"INFO",
    "thread":"main",
    "message":"Message flushed with immediate flush=true"
  },

Looks like format have changed and OLV will have to support both formats.

@otros-systems otros-systems added this to the 1.4.11 milestone Jul 18, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants