1

错误和报告工具无法识别严重性为“ERROR”的日志。应用程序日志正在使用 fluentd 代理定向到 Google Stackdriver Logging，其中一些是第三方 Java 组件。

{
 insertId:  "14sf3lvg3ccncgh"   
 jsonPayload: {
   class:  "o.a.w.MarkupContainer"    
   message:  "Unable to find component with id 'search2' in [Form [Component id = form]]
              Expected: 'form:search2'.
              Found with similar names: 'form:search'
        at org.apache.wicket.markup.MarkupStream.throwMarkupException(MarkupStream.java:526) ~[wicket-core-6.22.0.jar:6.22.0]
        at org.apache.wicket.MarkupContainer.renderNext(MarkupContainer.java:1438) ~[wicket-core-6.22.0.jar:6.22.0]
        at org.apache.wicket.MarkupContainer.renderAll(MarkupContainer.java:1557) ~[wicket-core-6.22.0.jar:6.22.0]
        at org.apache.wicket.MarkupContainer.renderComponentTagBody(MarkupContainer.java:1532) ~[wicket-core-6.22.0.jar:6.22.0]
        at org.apache.wicket.MarkupContainer.onComponentTagBody(MarkupContainer.java:1487) ~[wicket-core-6.22.0.jar:6.22.0]"    
   milsec:  "576"    
   reportLocation: {…}    
   serviceContext: {…}    
   tag:  "test.gui"    
   thread:  "[ajp-apr-8009-exec-5]"    
 }
 labels: {…}   
 logName:  "projects/myservice/logs/test.gui"   
 receiveTimestamp:  "2017-08-29T15:20:16.847782870Z"   
 resource: {…}   
 severity:  "ERROR"   
 timestamp:  "2017-08-29T15:20:11Z"   
}

使用以下配置可以将我的应用程序日志正确转发到 Google 的 Stackdriver 日志记录，并且正确识别所有条目。

<source>
  @type tail
  path /var/log/test/test_gui/test_gui.log
  pos_file /var/lib/google-fluentd/pos/test_gui-multiline.pos
  read_from_head true
  tag test.gui
  format multiline
  time_format %Y-%m-%d %H:%M:%S
  format_firstline /\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2},\d{1,3}\s(?<severity>\S*)/
  format1 /^(?<time>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}),(?<milsec>\d{1,3})\s(?<severity>\S*)\s(?<class>\S*)\s(?<thread>\[\S*\])\s(?<message>.*)/
</source>

但是对于严重性ERROR，错误报告从未注意到这些条目。

输出被标识为textPayLoad，我使用了以下过滤器，确保输出为jsonPayload 

<filter test.gui>
  @type record_transformer
  <record>
    serviceContext {"service": "test.gui", "version": "1"}
    reportLocation {"filePath": "test_gui.log", "lineNumber": "unknown", "functionName": "unknown"}
   tag ${tag}
  </record>
</filter>

仍然忽略错误 jsonPayload。

如果我使用过滤器替换消息，那么突然错误报告正在工作

 <filter test.gui>
      @type record_transformer
      <record>
        serviceContext {"service": "test.gui", "version": "1"}
        reportLocation {"filePath": "test_gui.log", "lineNumber": "unknown", 
        "functionName": "unknown"}
        message "java.lang.TestError: msg
           at com.example.TestClass.test (TestClass.java:51)
           at com.example.AnotherClass (AnotherClass.java:25)"
       tag ${tag}
     </record>
    </filter>

我如何强制错误报告选择这些错误条目，因为我的下一步是实施某种形式的警报。

4

1 回答 1

1

第三方未生成正确的 Java 堆栈跟踪。我需要reportLocation，但这需要在上下文中。

我更改了以下行：

reportLocation {"filePath": "test_gui.log", "lineNumber": "unknown", "functionName": "unknown"}

至

context { "reportLocation" : {"filePath": "test_gui.log", "lineNumber": 1, "functionName": "unknown"} }

这确保了 Stackdriver Error Reporting 现在可以获取日志。

这是我的过滤器的最终版本：

<filter test.gui>
  @type record_transformer
  <record>
    serviceContext {"service": "test.gui", "version": "1"}
    context { "reportLocation" : {"filePath": "test_gui.log", "lineNumber": 1, "functionName": "unknown"} }
   tag ${tag}
  </record>
</filter>
于 2017-08-30T14:28:06.220 回答