{"action":"opened","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-input-log4j/issues/13","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-input-log4j/issues/13/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-input-log4j/issues/13/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-input-log4j/issues/13/events","html_url":"https://github.com/logstash-plugins/logstash-input-log4j/issues/13","id":95181533,"number":13,"title":"Log4J input is not working with SocketAppender (Logstash 1.5.2)","user":{"login":"vnyvh","id":1750457,"avatar_url":"https://avatars.githubusercontent.com/u/1750457?v=3","gravatar_id":"","url":"https://api.github.com/users/vnyvh","html_url":"https://github.com/vnyvh","followers_url":"https://api.github.com/users/vnyvh/followers","following_url":"https://api.github.com/users/vnyvh/following{/other_user}","gists_url":"https://api.github.com/users/vnyvh/gists{/gist_id}","starred_url":"https://api.github.com/users/vnyvh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vnyvh/subscriptions","organizations_url":"https://api.github.com/users/vnyvh/orgs","repos_url":"https://api.github.com/users/vnyvh/repos","events_url":"https://api.github.com/users/vnyvh/events{/privacy}","received_events_url":"https://api.github.com/users/vnyvh/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-07-15T12:35:34Z","updated_at":"2015-07-15T12:35:34Z","closed_at":null,"body":"\r\n\r\nI am using Logstash 1.5.2 with Elasticsearch. I am trying to read the events from Log4J SocketAppender. Following is my configuration -\r\nLogstash conf -\r\nlog4j {\r\ntype => \"log4j\"\r\nhost => \"localhost\"\r\nport => 4560\r\nadd_field => [ \"index\", \"mma-app-log\" ]\r\nadd_field => [ \"parsing\", \"success\" ]\r\n}\r\n\r\nHere is my Log4J config -\r\n\r\n\r\nWhenever I start Logstash I get following warnings -\r\nio/console not supported; tty will not be manipulated\r\n'[DEPRECATED] use require 'concurrent' instead of require 'concurrent_ruby'\r\nlog4j:WARN No appenders could be found for logger (org.apache.http.impl.conn.PoolingHttpClientConnectionManager).\r\nlog4j:WARN Please initialize the log4j system properly.\r\nlog4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.\r\nLogstash startup completed\r\n\r\nAnd when I start my app server, the SocketAppender throws following error -\r\nERROR Failed to asynchronously log message: org.apache.logging.log4j.core.async.AsyncLoggerConfigHelper$Log4jEventWrapper@7dbfbfd org.apache.logging.log4j.core.appender.AppenderLoggingException: Error writing to TCP:localhost:4560\r\nat org.apache.logging.log4j.core.net.TcpSocketManager.write(TcpSocketManager.java:134)\r\nat org.apache.logging.log4j.core.appender.OutputStreamManager.write(OutputStreamManager.java:136)\r\nat org.apache.logging.log4j.core.appender.AbstractOutputStreamAppender.append(AbstractOutputStreamAppender.java:110)\r\nat org.apache.logging.log4j.core.config.AppenderControl.callAppender(AppenderControl.java:99)\r\nat org.apache.logging.log4j.core.config.LoggerConfig.callAppenders(LoggerConfig.java:430)\r\nat org.apache.logging.log4j.core.async.AsyncLoggerConfig.asyncCallAppenders(AsyncLoggerConfig.java:121)\r\nat org.apache.logging.log4j.core.async.AsyncLoggerConfigHelper$Log4jEventWrapperHandler.onEvent(AsyncLoggerConfigHelper.java:222)\r\nat org.apache.logging.log4j.core.async.AsyncLoggerConfigHelper$Log4jEventWrapperHandler.onEvent(AsyncLoggerConfigHelper.java:207)\r\nat com.lmax.disruptor.BatchEventProcessor.run(BatchEventProcessor.java:128)\r\nat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)\r\nat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)\r\nat java.lang.Thread.run(Thread.java:745)\r\nCaused by: java.net.SocketException: Software caused connection abort: socket write error\r\nat java.net.SocketOutputStream.socketWrite0(Native Method)\r\nat java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:113)\r\nat java.net.SocketOutputStream.write(SocketOutputStream.java:159)\r\nat org.apache.logging.log4j.core.net.TcpSocketManager.write(TcpSocketManager.java:125)\r\n... 11 more\r\n\r\nBut if I replace Log4j input with tcp, everything works fine and I do not get any warnings for Logstash.\r\n\r\nI am using JDK1.8, Logstash1.5.2, elasticsearch-1.6.0 (all ELK components are downloaded from https://www.elastic.co.\r\n"}}