TheHive-Project / TheHive-Project/Cortex

Cortex logstash logback support missing

Open
#228 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Scala
Stars
1.6k
Forks
264
PR merge metrics
No merged PRs in 30d

Description

Feature Request

Work Environment
Question Answer
OS version (server) CentOS
OS version (client) 7
Cortex version / git hash cortex-3.0.0-0.1RC3.noarch
Package Type Binary
Browser type & version -
Problem Description

Cortex cant sent appliaction logs to the logstash because some dependencie is missing.

Steps to Reproduce
  1. Modify logback.xml

Add

  <appender name="STASH"
        class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>192.168.99.100:5000</destination>
 </appender>

and append the root section with this:

<appender-ref ref="LOGSTASH" />
  1. start cortex

  2. read the log

11:50:05,015 |-ERROR in ch.qos.logback.core.joran.action.AppenderAction - Could not create an Appender of type [net.logstash.logback.appender.LogstashTcpSocketAppender]. ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type net.logstash.logback.appender.LogstashTcpSocketAppender at ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type net.logstash.logback.appender.LogstashTcpSocketAppender Caused by: java.lang.ClassNotFoundException: net.logstash.logback.appender.LogstashTcpSocketAppender

Possible Solutions

Maybe this: https://stackoverflow.com/questions/46582135/logstash-failed-to-instantiate-type-net-logstash-logback-appender-logstashtcps

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the logback.xml configuration and the reported ClassNotFoundException for net.logstash.logback.appender.LogstashTcpSocketAppender. Check how Cortex packages its logging dependencies and compare the proposed dependency guidance in the linked Stack Overflow discussion. Done means Cortex starts with the appender configured and application logs can be sent to Logstash without the class-loading error.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, scala
Domain
backend, observability-sre
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.