解析log4j日志文件
我们有几个使用 log4j 进行日志记录的应用程序。我需要让 log4j 解析器正常工作，以便我们可以组合多个日志文件并对它们运行自动分析。我不想重新发明轮子，所以有人可以给我指出一个像样的现有解析器吗？如果有帮助的话，我确实有 log4j 转换模式。
如果没有，我就得自己动手了。
We have several applications that use log4j for logging. I need to get a log4j parser working so we can combine multiple log files and run automated analysis on them. I'm not looking to reinvent the wheel, so can someone point me to a decent pre-existing parser? I do have the log4j conversion pattern if that helps.
If not, I'll have to roll our own.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
我没有意识到 Log4J 附带了 XML 附加程序。
解决方案是：在日志记录配置文件中指定一个 XML 附加程序，将输出 XML 文件作为实体包含到格式良好的 XML 文件中，然后使用您最喜欢的技术解析 XML。
其他方法有以下限制：
I didn't realize that Log4J ships with an XML appender.
Solution was: specify an XML appender in the logging configuration file, include that output XML file as an entity into a well formed XML file, then parse the XML using your favorite technique.
The other methods had the following limitations:
您可以将 OtrosLogViewer 与 批处理。您必须：
You can use OtrosLogViewer with batch processing. You have to:
您正在寻找的内容称为SawMill，或类似的东西。
What you are looking for is called SawMill, or something like it.
Log4j 日志文件并不真正适合解析，它们太复杂且非结构化。我相信有第三方工具可以做到这一点（例如 Sawmill）。
如果您需要对日志执行自动化的自定义分析，您应该考虑记录到数据库并进行分析。 JDBC 附带
JdbcAppender它将所有消息附加到您选择的数据库中，但它会影响性能，而且有点不稳定。不过，互联网上还有其他类似的替代方案（例如这个）。Log4j log files aren't really suitable for parsing, they're too complex and unstructured. There are third party tools that can do it, I believe (e.g. Sawmill).
If you need to perform automated, custom analysis of the logs, you should consider logging to a database, and analysing that. JDBC ships with the
JdbcAppenderwhich appends all messages to a database of your choice, but it has performance implications, and it's a bit flaky. There are other, similar, alternatives on the interweb, though (like this one).当优先考虑自动化时，
xmlstarlet是解析 log4j 日志的绝佳选择。它是最适合此任务的实用程序之一有几个关键原因：XPath 支持：
xmlstarlet支持 XPath，这是一种强大而灵活的导航语言以及查询 XML 文档。在 log4j 日志的上下文中，这允许您精确地定位特定元素和属性。命令行界面：它通过命令行运行，可以轻松集成到脚本和自动化工作流程中。这对于以批处理或计划的方式处理日志文件非常有用。
修改和转换：除了解析之外，
xmlstarlet还可用于对 XML 文档进行更改。在 log4j 日志中，这意味着您可以编辑或重新格式化日志条目，使其成为日志文件分析和维护的多功能工具。兼容性：它可在各种平台上使用，包括 Windows、Linux 和 macOS，因此适用于各种环境。
文档丰富：
xmlstarlet拥有一套全面且文档齐全的功能，这简化了新手的学习曲线。当涉及自动化时，文档至关重要，因为它可以确保脚本编写的清晰指导。社区和支持：作为一种广泛使用的实用程序，
xmlstarlet拥有活跃的社区和大量在线资源。如果您遇到问题或需要自动化脚本方面的帮助，您可能会找到所需的帮助。对于解析 log4j 日志，
xmlstarlet特别有用，因为 log4j 日志通常采用 XML 格式。凭借其功能，自动化变得简单，可以有效管理日志聚合、过滤和警报等任务。最后，如果您正在寻找可靠且强大的解决方案来解析 log4j 日志并需要自动化功能，那么
xmlstarlet应该是您的首选。xmlstarletis an excellent choice for parsing log4j logs when automation is a priority. There are several key reasons why it's one of the best suitable utilities for this task:XPath Support:
xmlstarletsupports XPath, which is a powerful and flexible language for navigating and querying XML documents. In the context of log4j logs, this allows you to target specific elements and attributes with precision.Command-Line Interface: It operates via the command line, making it easy to integrate into scripts and automated workflows. This is invaluable for processing log files in a batch or scheduled manner.
Modifications and Transformations: Beyond just parsing,
xmlstarletcan be used to make changes to XML documents. In log4j logs, this means you can edit or reformat log entries, making it a versatile tool for log file analysis and maintenance.Compatibility: It's available on various platforms, including Windows, Linux, and macOS, making it suitable for a wide range of environments.
Well-Documented:
xmlstarlethas a comprehensive and well-documented set of features, which simplifies the learning curve for those who are new to it. Documentation is crucial when automation is involved, as it ensures clear guidance for scripting.Community and Support: Being a widely-used utility,
xmlstarlethas an active community and plenty of online resources. If you run into issues or need assistance with automation scripts, you're likely to find the help you need.For parsing log4j logs,
xmlstarletis particularly beneficial because log4j logs are often formatted as XML. With its features, automation becomes straightforward, enabling tasks like log aggregation, filtering, and alerting to be efficiently managed.Ultimately, if you're looking for a dependable and robust solution for parsing log4j logs and need automation capabilities,
xmlstarletshould be at the top of your list.您可以使用 Log4j 的 Chainsaw V2 来处理各种日志文件并将它们收集到一张表中，然后将这些事件输出为 xml 或使用 Chainsaw 内置的基于表达式的过滤、搜索和分析。对切片和切片的着色支持将原木切丁。
步骤：
- 启动电锯 V2
- 通过复制“欢迎”选项卡中提供的示例配置文件来创建链锯配置文件 - 为要处理的每个日志文件定义一个 LogFilePatternReceiver“插件”条目
- 使用该配置启动 Chainsaw
- 每个日志文件最终将作为用户界面中的单独选项卡
- 暂停链锯日志选项卡并清除该选项卡中的事件
- 创建一个新选项卡，通过转到“查看、创建自定义表达式日志面板”菜单项并在框中输入“级别 >= DEBUG”来聚合来自各个选项卡的事件。它将创建一个新选项卡，其中包含级别 >= debug 的所有选项卡中的事件（这就是您清除链锯日志选项卡的原因）。
您可以从教程（可从“帮助”菜单中获取）中获取用于过滤、着色和搜索的表达式语法的概述。
如果您不想使用 Chainsaw，您可以执行类似的操作 - 启动一个简单的应用程序，该应用程序不记录日志，但会使用您为 Chainsaw 配置定义的“插件”条目加载 log4j.xml 配置文件，同时还定义一个具有 xmllayout 的 FileAppender - “接收器”接收到的所有事件都将发送到单个附加程序。
You -can- use Log4j's Chainsaw V2 to process the various log files and collect them into one table, and either output those events as xml or use Chainsaw's built-in expression-based filtering, searching & colorizing support to slice & dice the logs.
Steps:
- Start Chainsaw V2
- Create a chainsaw configuration file by copying the example configuration file available from the Welcome tab - define one LogFilePatternReceiver 'plugin' entry for each log file that you want to process
- Start Chainsaw with that configuration
- Each log file will end up as a separate tab in the UI
- Pause the chainsaw-log tab and clear the events from that tab
- Create a new tab which aggregates the events from the various tabs by going to the 'view, crate custom expression logpanel' menu item and enter 'level >= DEBUG' in the box. It will create a new tab containing events from all of the tabs with level >= debug (which is why you cleared the chainsaw-log tab).
You can get an overview of the expression syntax used to filter, colorize and search from the tutorial (available from the Help menu).
If you don't want to use Chainsaw, you can do something similar - start a simple app that doesn't log but loads a log4j.xml config file with the 'plugin' entries you defined for the Chainsaw configuration, but also define a FileAppender with an xmllayout - all of the events received by the 'receivers' will be sent to the single appender.