Logstash5版本接收log4j数据异常

异常描述

logstash版本：5.1.1

log4j.properties配置：

log4j.rootLogger=WARN, Console, RollingFile, logstash

log4j.appender.logstash=org.apache.log4j.net.SocketAppender
log4j.appender.logstash.Port=4560
log4j.appender.logstash.RemoteHost=172.18.84.66
log4j.appender.logstash.ReconnectionDelay=60000
log4j.appender.logstash.LocationInfo=true

logstash脚本:

input {
    log4j {
        type => "test-log4j"
        host => "172.18.84.66"
        port => 4560
    }
}
output {
    elasticsearch {
        hosts => "xdata66"
    }
    stdout{
        codec => rubydebug
 }
}

web项目启动时，报错：

log4j:WARN Detected problem with connection: java.net.SocketException: Software caused connection abort: socket write error

解决方案

打开文件

cd $LOGSTASH_HOME
vi logstash-core/lib/logstash-core_jars.rb

注释下行代码

# this is a generated file, to avoid over-writing it just delete this comment
begin
  require 'jar_dependencies'
rescue LoadError
  require 'org/apache/logging/log4j/log4j-core/2.6.2/log4j-core-2.6.2.jar'
  require 'org/apache/logging/log4j/log4j-api/2.6.2/log4j-api-2.6.2.jar'
  require 'com/fasterxml/jackson/core/jackson-core/2.7.4/jackson-core-2.7.4.jar'
  require 'org/apache/logging/log4j/log4j-1.2-api/2.6.2/log4j-1.2-api-2.6.2.jar'
  require 'com/fasterxml/jackson/core/jackson-annotations/2.7.0/jackson-annotations-2.7.0.jar'
  require 'com/fasterxml/jackson/core/jackson-databind/2.7.4/jackson-databind-2.7.4.jar'
end

if defined? Jars
  require_jar( 'org.apache.logging.log4j', 'log4j-core', '2.6.2' )
  require_jar( 'org.apache.logging.log4j', 'log4j-api', '2.6.2' )
  require_jar( 'com.fasterxml.jackson.core', 'jackson-core', '2.7.4' )
# require_jar( 'org.apache.logging.log4j', 'log4j-1.2-api', '2.6.2' )
  require_jar( 'com.fasterxml.jackson.core', 'jackson-annotations', '2.7.0' )
  require_jar( 'com.fasterxml.jackson.core', 'jackson-databind', '2.7.4' )
end

保存修改，启动logstash

bin/logstash -f conf/logstash_log4j.conf

重启web服务器，ok。