graylog | Tiny typed library to send

In my case, there was no need to use NLog at all. It was just a logging framework which no one attempted to dive into.

So a better alternative is to use GELF logger provider for Microsoft.Extensions.Logging: Gelf.Extensions.Logging - https://github.com/mattwcole/gelf-extensions-logging Don't forget to disable GELF for docker container if it is enabled.

It supports additional fields, parameterization of the formatted string (parameters in curly braces {} become the graylog fields) and is easily configured via appsettings.json

Some might consider this not be an answer since I was using NLog, but for me -- this is a neat way to send customized logs without much trouble. As for NLog, I could not come up with a solution.

Looks like we have an existing issue opened to address this. Also from that issue, someone has made a python script that can be put in a cron job to handle it. However, I can't vouch for if/how well it works. Hopefully it can work for you as a work around. It doesn't seem like that functionality would be too large of a task to build into Graylog, so I may check that out myself.

This was tested using Visual Studio 2019 and serialize libraries. Everything is working properly.

using Newtonsoft.Json

Is there another possibility to read the logs directly from STDOUT and send them into Graylog?

Fluent Bit allows for data collection through STDIN. Redirect your application STDOUT to Fluent Bit's STDIN and you are set.

If I have to log the log messages into a log file to be read from fluent-bit: Do I have to configure log4j to do some roll-over strategies to prevent, that the log file will be bigger and bigger? I do not want to "waste" my resources "just" for logging.

In this case you can use logrotate

How do you handle application logs in K8s?

Three possible ways:

1. Application directly output their traces in external systems (eg. databases).
2. Sidecar container with embedded logging agent that collect application traces and send them to a store (again database for example).
3. Cluster-wide centralized logging (eg. ELK stack)

I'd recommend you to use sidecar container for log collection. This is probably most widely used solution.

You will need to define variables explicitly or change configmaps so they have 1 environment variable = 1 value structure, this way you will be able to refer to them using envFrom. E.g.:

Is this is the query you're looking for?

1. (not related) You don't need to json_decode the result get_graylog_inputs.content. If the server on the over side sends the correct Content-type: application/json header, you should have a get_graylog_inputs.json entry containing the already decoded json result.
2. You don't need to loop twice. Remove the set_fact loop (which is not correct anyway) in your first file and use the value from your register directly in the second loop.
3. You did not show any example of your input data so I have to guess a bit here from your jmespath expression... but you basically don't need json_query at all and can stick to generic core ansible filters.

Here is how I see the solution in the second file once you cleaned-up the first:

You should use Correlation Id to track your requests. A Correlation ID, also known as a Transit ID, is a unique identifier value that is attached to requests and messages that allow reference to a particular transaction or event chain. A Correlation ID is defined as a non-standard HTTP header and is part of the Java Messaging Service (JMS).

Here you have a link with the best practices for Serilog.

https://benfoster.io/blog/serilog-best-practices/

The error message says that the connection is refused (=the port is closed). This is because you have used localhost as the database address here: