README

JSON Context for Monolog

Simple helper package with Monolog formatters.

This helps to set up consistent JSON context log output. The aim of these formatters is to write log lines that may easily be grokked by logstash.

Example Filebeat + Logstash setup

Filebeat configuration

# ...

filebeat.prospectors:

- type: log
  enabled: true
  paths:
    - /usr/some/path/*.log
  tail_files: true
  multiline:
    pattern: '^\[[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}'
    negate: true
    match: after
  fields:
    source: context_json
    index: testing

# ...

Logstash configuration

input {
  beats {
    port => 5000
  }
}

filter {

    # Split up the custom message into fields
    grok {
      match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:channel}\.%{LOGLEVEL:severity}: %{GREEDYDATA:context}" }
      overwrite => [ "message", "context" ]
    }
    
    # Take the timestamp from the log line and use it for @timestamp
    date {
      match => [ "timestamp", "yyyy-MM-dd HH:mm:ss" ]
    }
    
    # Clean up (optional)
    mutate {
      remove_field => ["timestamp", "prospector", "beat"]
    }
    
    # Pull fields.index up one level, add it so we can use it in the output.
    # Optional, but I needed this to get `index => "%{index}-%{+YYYY.MM}"` 
    # working for the elasticsearch output.
    if (![fields][index]) {
      mutate {
        add_field => { "index" => "default" }
      }
    } else {
      mutate {
        add_field => { "index" => "%{[fields][index]}" }
        remove_field => "[fields][index]"
      }
    }
    
    # Make sure to interpret the context field as JSON
    json {
        source => "context"
    }
}

output {
  elasticsearch {
    hosts => "elasticsearch:9200"
    index => "%{index}-%{+YYYY.MM}"
  }
}

PHP

<?php
$formatter = new \Czim\MonologJsonContext\Formatters\JsonContextFormatter(null, 'test-application');

$logger = (new \Monolog\Logger('channel'))
    ->pushHandler(
        (new \Monolog\Handler\RotatingFileHandler('/usr/some/path/test.log', 7))
            ->setFormatter(
                
            )
    );

$logger->info('Your message', ['testing' => true, 'category' => 'documentation.test']);

Credits

• All Contributors

License

The MIT License (MIT). Please see License File for more information.