observability

timo 2022-02-18T12:56:35.989489Z

For my understanding: When I don't see the data part of log messages like (log/error "Foo" {:bar "baz"} parsed in elasticsearch but only as a string. Does it mean that the setup is wrong? Should I work on the parsing-config in e.g. logstash? Or is this the way it is?

lukasz 2022-02-18T14:53:32.930439Z

I never used logstash, but I worked with fluentd and yes - you have to setup a parser on logstash side, and/or emit JSON from your application logs as well

👍 1
timo 2022-02-18T18:53:59.044449Z

ok, actually it seems to me that we are using fluentd as well at my new job...will look into that. Thanks!

lukasz 2022-02-18T19:03:03.736099Z

I'm sorry to hear that, it's not my fav piece of software :-(

lukasz 2022-02-18T19:03:20.218489Z

we're prepping a POC with http://vector.dev

lukasz 2022-02-18T19:03:28.891699Z

as we had way too many issues with fluentd

timo 2022-02-18T19:23:47.545969Z

good to know...I would love to use ulog for application-logs anyway so that there is no need to go through fluentd or something similar anymore

lukasz 2022-02-18T19:54:39.385279Z

It's still a good practice to have a collector (or forwarder sidecar) so that your app doesn't depend directly on your log storage - we run into a lot of issues when using logback and google cloud logging few years ago, so it was better to front it with something else

timo 2022-02-18T20:16:26.320849Z

makes sense