On Mon, Jun 18, 2012 at 6:53 PM, Ralph Goers <rgoers@apache.org> wrote:
As you noted this subject has come up before. It was one of the things that ultimately motivated me to go off and create Log4j 2. I abandoned the fork at Github when it became clear that there wasn't going to be a good resolution to the issue.
For now I went for an approach using a custom Appender (that inherits from SyslogAppenderBase), a new ClassicConverter for the syslog header and another ClassicConverter for the structured data. The latter needs to inspect the ILoggingEvent's argument array for the presence of a special interface, which is a little ugly, but technically works...
I'm not sure what value the second link has.
Me neither. ;-)
I've gotten RFC 5424 to work with several systems including Splunk, rsyslog and syslog-ng. FWIW, my use case is Apache Log4j 2 Flume Appender -> Apache Flume -> Apache Cassandra. What is interesting here is that while RFC 5424 isn't strictly necessary for Flume integration, structured data is, at least for what we are using it for.
For now I "just" need to feed structured data into rsyslog, but this is probably going to change some time. Thanks, Thilo