Question

错误和报告工具无法识别严重性为“ERROR”的日志。应用程序日志使用流利的代理进行Google Stackdriver日志记录，其中一些是第三方Java组件。

{
 insertId:  "14sf3lvg3ccncgh"   
 jsonPayload: {
   class:  "o.a.w.MarkupContainer"    
   message:  "Unable to find component with id 'search2' in [Form [Component id = form]]
              Expected: 'form:search2'.
              Found with similar names: 'form:search'
        at org.apache.wicket.markup.MarkupStream.throwMarkupException(MarkupStream.java:526) ~[wicket-core-6.22.0.jar:6.22.0]
        at org.apache.wicket.MarkupContainer.renderNext(MarkupContainer.java:1438) ~[wicket-core-6.22.0.jar:6.22.0]
        at org.apache.wicket.MarkupContainer.renderAll(MarkupContainer.java:1557) ~[wicket-core-6.22.0.jar:6.22.0]
        at org.apache.wicket.MarkupContainer.renderComponentTagBody(MarkupContainer.java:1532) ~[wicket-core-6.22.0.jar:6.22.0]
        at org.apache.wicket.MarkupContainer.onComponentTagBody(MarkupContainer.java:1487) ~[wicket-core-6.22.0.jar:6.22.0]"    
   milsec:  "576"    
   reportLocation: {…}    
   serviceContext: {…}    
   tag:  "test.gui"    
   thread:  "[ajp-apr-8009-exec-5]"    
 }
 labels: {…}   
 logName:  "projects/myservice/logs/test.gui"   
 receiveTimestamp:  "2017-08-29T15:20:16.847782870Z"   
 resource: {…}   
 severity:  "ERROR"   
 timestamp:  "2017-08-29T15:20:11Z"   
}

使用以下配置可以将我的应用程序日志正确转发到Googles Stackdriver日志记录，并且所有条目都已正确识别。

<source>
  @type tail
  path /var/log/test/test_gui/test_gui.log
  pos_file /var/lib/google-fluentd/pos/test_gui-multiline.pos
  read_from_head true
  tag test.gui
  format multiline
  time_format %Y-%m-%d %H:%M:%S
  format_firstline /\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2},\d{1,3}\s(?<severity>\S*)/
  format1 /^(?<time>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}),(?<milsec>\d{1,3})\s(?<severity>\S*)\s(?<class>\S*)\s(?<thread>\[\S*\])\s(?<message>.*)/
</source>

但是，对于严重性错误，错误报告从未注意到这些条目。

输出被识别为 textPayLoad ，我使用了以下过滤器，确保输出 jsonPayload

<filter test.gui>
  @type record_transformer
  <record>
    serviceContext {"service": "test.gui", "version": "1"}
    reportLocation {"filePath": "test_gui.log", "lineNumber": "unknown", "functionName": "unknown"}
   tag ${tag}
  </record>
</filter>

仍然忽略错误jsonPayload。

如果我使用过滤器替换邮件，则突然错误报告正在运行

 <filter test.gui>
      @type record_transformer
      <record>
        serviceContext {"service": "test.gui", "version": "1"}
        reportLocation {"filePath": "test_gui.log", "lineNumber": "unknown", 
        "functionName": "unknown"}
        message "java.lang.TestError: msg
           at com.example.TestClass.test (TestClass.java:51)
           at com.example.AnotherClass (AnotherClass.java:25)"
       tag ${tag}
     </record>
    </filter>

如何强制错误报告选择这些错误条目，因为我的下一步是实施某种形式的警报。

Answer 1

第三方没有生成正确的Java Stack跟踪。我需要reportLocation，但这需要在上下文中。

我更改了以下行：

reportLocation {"filePath": "test_gui.log", "lineNumber": "unknown", "functionName": "unknown"}

到

context { "reportLocation" : {"filePath": "test_gui.log", "lineNumber": 1, "functionName": "unknown"} }

确保堆栈驱动程序错误报告现在可以获取日志。

这是我的过滤器的最终版本：

<filter test.gui>
  @type record_transformer
  <record>
    serviceContext {"service": "test.gui", "version": "1"}
    context { "reportLocation" : {"filePath": "test_gui.log", "lineNumber": 1, "functionName": "unknown"} }
   tag ${tag}
  </record>
</filter>

Google Stackdriver错误报告没有收到错误

1 个答案: