Question

我有一个mulesoft本地独立服务器，我希望应用程序将日志转发到splunk，我使用端口8088（默认值）获得了splunk url（http）

网址：http：//：8088 / services / collector / raw

我通过更新src / main / resources下的log4j2.xml部署了一个mule应用程序，在服务器上它抛出了此错误

试图遵循本文：https://dzone.com/articles/recipe-to-implement-splunk-enterprise-on-premise-f

ERROR 2020-07-21 11:05:48,067 [pool-58-thread-2] [event: ] com.mulesoft.agent.common.internalhandler.splunk.transport.HECTransport: There was an error executing the request.
java.util.concurrent.ExecutionException: org.asynchttpclient.exception.RemotelyClosedException: Remotely closed
    at java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:357) ~[?:1.8.0_252]
    at java.util.concurrent.CompletableFuture.get(CompletableFuture.java:1908) ~[?:1.8.0_252]
    at org.asynchttpclient.netty.NettyResponseFuture.get(NettyResponseFuture.java:213) ~[?:?]
    at com.mulesoft.agent.common.internalhandler.splunk.transport.HECTransport.send(HECTransport.java:127) ~[?:?]
    at com.mulesoft.agent.common.internalhandler.AbstractSplunkInternalHandler.flush(AbstractSplunkInternalHandler.java:173) ~[?:?]
    at com.mulesoft.agent.buffer.BufferedHandler.flushBuffer(BufferedHandler.java:241) ~[?:?]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_252]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_252]
    at java.lang.Thread.run(Thread.java:748) [?:1.8.0_252]
Caused by: org.asynchttpclient.exception.RemotelyClosedException: Remotely closed
    at org.asynchttpclient.exception.RemotelyClosedException.INSTANCE(Unknown Source) ~[?:?]
INFO  2020-07-21 11:05:48,083 [pool-58-thread-2] [event: ] com.mulesoft.agent.buffer.BufferedHandler: Trying to retry flushing on buffer for EventTrackingSplunkInternalHandler. Remaining attempts: 0

在log4j2文件中添加了以下部分

 <Http name="Splunk" url="http://xxxx-xxxxx-xxx:8088/services/collector/raw">
            <Property name="Authorization" value="Splunk e052f3fa-xxxxxxxxxx" ></Property>
            <PatternLayout pattern="[%d{MM-dd HH:mm:ss}] %-5p %c{1} [%t]: %m%n"></PatternLayout>
        </Http>

和

 <AsyncRoot level="INFO">
            <AppenderRef ref="Splunk" ></AppenderRef>
        </AsyncRoot>

Answer 1

您看到的错误与将日志从log4j2发送到Splunk无关。您已遵循标题为“使用Anypoint Runtime Manager在服务器组上启用Splunk”标题下的链接的说明。本文的该部分用于从应用程序内部通过Runtime Manager代理向Splunk发送事件。这与日志记录完全分开。在Runtime Manager中禁用Splunk事件跟踪，该错误应消失。

从本地到Splunk的MuleSoft日志转发

1 个答案: