feat: (server) send logs to elasticsearch with proper formating (foyz…

…ulkarim#86)
aninda052 · Sep 27, 2023 · d1f38bd · d1f38bd
1 parent 601d837
commit d1f38bd
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 6 deletions.
diff --git a/server/.ef670e866adee2a3b2bd408d90586049413043f9-audit.json b/server/.ef670e866adee2a3b2bd408d90586049413043f9-audit.json
@@ -0,0 +1,20 @@
+{
+    "keep": {
+        "days": true,
+        "amount": 14
+    },
+    "auditLog": ".ef670e866adee2a3b2bd408d90586049413043f9-audit.json",
+    "files": [
+        {
+            "date": 1695732103032,
+            "name": "application-2023-09-26-18.log",
+            "hash": "79ee3cf2b1fa330f399d3b775bd859db3a9f62a9af4c9c33bbe786dc0d222457"
+        },
+        {
+            "date": 1695746509756,
+            "name": "application-2023-09-26-22.log",
+            "hash": "90f46d8772b164be1848255e9d234603a4a51516c958579d1c5b901b9e59363e"
+        }
+    ],
+    "hashType": "sha256"
+}
diff --git a/server/EKA-docker/docker-compose.yml b/server/EKA-docker/docker-compose.yml
@@ -127,10 +127,6 @@ services:
       - KIBANA_HOST=${KIBANA_HOST:-kibana}
       - ELASTICSEARCH_USERNAME=${ELASTICSEARCH_USERNAME:-elastic}
       - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD:-change_me}
-    labels:
-      co.elastic.logs/json.overwrite_keys: true 
-      co.elastic.logs/json.add_error_key: true 
-      co.elastic.logs/json.expand_keys: true 
 
 volumes:
   elasticsearch-data:

diff --git a/server/EKA-docker/filebeat.yml b/server/EKA-docker/filebeat.yml
@@ -1,8 +1,14 @@
 filebeat.inputs:
-- type: log
+- type: filestream
   enabled: true
   paths:
   - "/var/log/server/*.log"
+  parsers:
+    - ndjson:
+      overwrite_keys: true 
+      add_error_key: true 
+      expand_keys: true 
+
 processors: 
   - add_host_metadata: ~
   # - add_cloud_metadata: ~
@@ -12,4 +18,7 @@ processors:
 output.elasticsearch:
   hosts: ["${ELASTICSEARCH_HOST}:9200"]
   username: ${ELASTICSEARCH_USERNAME}
-  password: ${ELASTICSEARCH_PASSWORD}
+  password: ${ELASTICSEARCH_PASSWORD}
+
+# output.console:
+#     pretty: true