Logstash and Playframework

I’m not sure why google let me down in regards to hooking up logstash and Play, but it sent me on some pretty weird paths. So I’m going to share what we did to get it working that is pretty simple in the end.

Play uses logback, first rule is don’t try to include a new version of logback in your build, that will cause you conflicts, the ootb Play dependencies are all you need, at the time I did this, we were using Play 2.3.8.

In your logback config, logger.xml, just wire up the appender you want, the tcp or udp one like this:

	<!– for udp –>
	<appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashSocketAppender">
	<host>logstash_server/host>
	<port>logstash_port</port>
	<encoder class="net.logstash.logback.encoder.LogstashEncoder" />
	</appender>
	<!– for tcp –>
	<appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
	<host>logstash_server/host>
	<port>logstash_port</port>
	<encoder class="net.logstash.logback.encoder.LogstashEncoder" />
	</appender>
	<!– include the appender –>
	<root level="INFO">
	<appender-ref ref="LOGSTASH" />
	</root>

view raw

gistfile1.xml

hosted with ❤ by GitHub

Then on the logstash config side create a new input:

	input {
	udp {
	codec => json
	port => XXXX
	type => logback
	}
	}

view raw

gistfile1.txt

hosted with ❤ by GitHub

This puts your data into a new type (called “logstash”) in the ES indices so that the json mappings don’t conflict with anything else. That’s it.