topic Re: Logtash Json logfiles vs Dynatrace in Log Analytics

Logstash Json logfiles vs Dynatrace

henk_stobbe — Wed, 13 Jul 2022 06:52:01 GMT

Hi,

When you implement logstash, Dynatrace is unable to read the replaced logfile, the new format is son,

Is it the one or the other?

KR Henk

Re: Logtash Json logfiles vs Dynatrace

skrystosik — Sat, 15 Jun 2019 16:01:58 GMT

I don’t understand your case. You are monitoring logstash and you want read logs that are created by this technology or you want to export some data to logstash?

Sebastian

Re: Logtash Json logfiles vs Dynatrace

henk_stobbe — Sun, 16 Jun 2019 07:30:43 GMT

Hi Sebastian,

my mistake: customer lets tomcat log in json format, I think to make live easy for logtash. So my question should have been, is dynatrace capable of reading json logs. And I think the answer will be no, or not yet?

KR Henk

Re: Logstash Json logfiles vs Dynatrace

skrystosik — Thu, 23 Mar 2023 12:57:39 GMT

Hello,

according to documentation:

https://www.dynatrace.com/support/help/how-to-use-dynatrace/log-analytics/basic-concepts/what-log-format-does-log-analytics-support/

JSON Formats are supported as well.

Sebastian

Re: Logtash Json logfiles vs Dynatrace

dave_mauney — Sun, 16 Jun 2019 12:03:57 GMT

Henk,

Check out the timestamp requirements on this page and make sure those are met:

https://www.dynatrace.com/support/help/how-to-use-dynatrace/log-analytics/basic-concepts/what-log-format-does-log-analytics-support/

HTH,

dave

Re: Logtash Json logfiles vs Dynatrace

henk_stobbe — Mon, 17 Jun 2019 08:11:54 GMT

Hi,

The json log contains a timestamp, is not marked as having an invalide date format but still,

Your search didn't return any log matches for the selected time frame

So could the conclusion be that the format is fine, but Dynatrace can not handle the invalide content of the date field?

See a example log line:

{"clientip":"xx.xx.xx.xxx","timestamp":"[17/Jun/2019:00:00:00 +0200]","request":"GET /xxxxxxx/api/internal/v1/xxxxxxxxxxxxxx=xxxxxxxx=xxxxxxxxxxxxx=true HTTP/1.1","urlpath":"/xxxxxx/api/internal/v1/xxxxxxxx","urlquery":"?xxxxxxxxx=xxxxxxx&xxxxxxxxxxx=XXXXXX&xxxxxxx=true","protocol":"HTTP/1.1","method":"GET","port":8080,"status":200,"bytes":12,"duration":57,"xxxxxxxxx:"xxxxxxxxxxxxxxxxx","xforwardedFor":"xx.xx.xx.xx"}

Re: Logtash Json logfiles vs Dynatrace

skrystosik — Mon, 17 Jun 2019 08:13:50 GMT

In link that I've provided is info that in JSON there is only one timestamp format that can be used (at least for now). Your is different so yes, log is ok but without proper detection of date you cannot search it.

Sebastian