TheHive-Project / TheHive-Project/Cortex
Cortex logstash logback support missing
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Feature Request
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | CentOS |
| OS version (client) | 7 |
| Cortex version / git hash | cortex-3.0.0-0.1RC3.noarch |
| Package Type | Binary |
| Browser type & version | - |
Problem Description
Cortex cant sent appliaction logs to the logstash because some dependencie is missing.
Steps to Reproduce
- Modify logback.xml
Add
<appender name="STASH"
class="net.logstash.logback.appender.LogstashTcpSocketAppender">
<destination>192.168.99.100:5000</destination>
</appender>
and append the root section with this:
<appender-ref ref="LOGSTASH" />
-
start cortex
-
read the log
11:50:05,015 |-ERROR in ch.qos.logback.core.joran.action.AppenderAction - Could not create an Appender of type [net.logstash.logback.appender.LogstashTcpSocketAppender]. ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type net.logstash.logback.appender.LogstashTcpSocketAppender
at ch.qos.logback.core.util.DynamicClassLoadingException: Failed to instantiate type net.logstash.logback.appender.LogstashTcpSocketAppender
Caused by: java.lang.ClassNotFoundException: net.logstash.logback.appender.LogstashTcpSocketAppender
Possible Solutions
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the logback.xml configuration and the reported ClassNotFoundException for net.logstash.logback.appender.LogstashTcpSocketAppender. Check how Cortex packages its logging dependencies and compare the proposed dependency guidance in the linked Stack Overflow discussion. Done means Cortex starts with the appender configured and application logs can be sent to Logstash without the class-loading error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, scala
- Domain
- backend, observability-sre
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100