Shipping logs to logstash

[mohsenomidi]

Hi every body,

I am using the spdlog in my project for logging interface, and it perfectly works, now in my environment there is a ELK and needs to send logs to Logstash, I am not expert in logstash and ELK stack, and I don't know what is best practice to shipping logs into logstash and does spdlog support this sink ?

I check the spdlog sinks and know there is TCP and UDP sinks.
Which one should I use? or Is there another way to communicate with Logstash (like queue or something else) ? which one is the best solution?

Is there any practice in this regards ?

for more information i want to share these conditions :

1. High-Load logs generated by app
2. Needs to transferred logs almost immediately into Logstash
3. My app should not pend for logstash store operation, once logstash server fails in any reason my app should work normally and after it alive send remaining data to it.

[tt4g]

Logstash sinks are not supported (I don't know how to do that with TCP/UDP sinks).
However, Filebeat should be able to forward logs written to a file to Logstash.

[mohsenomidi]

Would please check this Logstasg Document it supports TCP input, I don't know the TCP sink could work with it or not

[tt4g]

tcp_sink will send log messages formatted by spdlog to the specified destination.
From the documentation, you can parse messages with the codec option, so you may be able to parse messages sent by tcp_sink with the line or multiline codecs.

• Line codec plugin | Logstash Reference [7.14] | Elastic
• Multiline codec plugin | Logstash Reference [7.14] | Elastic

Note that tcp_sink does not resend log messages even if the data could not be sent to Logstash.

[mohsenomidi]

You mean tcp_sink can communicate with logstash and ship logs but there is no persistence guarantee.

[tt4g]

I'm not an expert on Logstash, so I can't guarantee that it will work. However, from the documentation, it seems to work.

[mohsenomidi]

Many thanks 🙏