从本地到 Splunk 的 MuleSoft 日志转发

Question

我有一个 mulesoft 本地独立服务器，我希望应用程序将日志转发到 splunk，我得到了带有端口 8088（默认）的 splunk url (http)

网址：http://:8088/services/collector/raw

我通过更新 src/main/resources 下的 log4j2.xml 部署了一个 mule 应用程序，在服务器上它抛出了这个错误

尝试关注这篇文章：https://dzone.com/articles/recipe-to-implement-splunk-enterprise-on-premise-f

ERROR 2020-07-21 11:05:48,067 [pool-58-thread-2] [event: ] com.mulesoft.agent.common.internalhandler.splunk.transport.HECTransport: There was an error executing the request.
java.util.concurrent.ExecutionException: org.asynchttpclient.exception.RemotelyClosedException: Remotely closed
    at java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:357) ~[?:1.8.0_252]
    at java.util.concurrent.CompletableFuture.get(CompletableFuture.java:1908) ~[?:1.8.0_252]
    at org.asynchttpclient.netty.NettyResponseFuture.get(NettyResponseFuture.java:213) ~[?:?]
    at com.mulesoft.agent.common.internalhandler.splunk.transport.HECTransport.send(HECTransport.java:127) ~[?:?]
    at com.mulesoft.agent.common.internalhandler.AbstractSplunkInternalHandler.flush(AbstractSplunkInternalHandler.java:173) ~[?:?]
    at com.mulesoft.agent.buffer.BufferedHandler.flushBuffer(BufferedHandler.java:241) ~[?:?]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_252]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_252]
    at java.lang.Thread.run(Thread.java:748) [?:1.8.0_252]
Caused by: org.asynchttpclient.exception.RemotelyClosedException: Remotely closed
    at org.asynchttpclient.exception.RemotelyClosedException.INSTANCE(Unknown Source) ~[?:?]
INFO  2020-07-21 11:05:48,083 [pool-58-thread-2] [event: ] com.mulesoft.agent.buffer.BufferedHandler: Trying to retry flushing on buffer for EventTrackingSplunkInternalHandler. Remaining attempts: 0

在 log4j2 文件中添加以下部分

 <Http name="Splunk" url="http://xxxx-xxxxx-xxx:8088/services/collector/raw">
            <Property name="Authorization" value="Splunk e052f3fa-xxxxxxxxxx" ></Property>
            <PatternLayout pattern="[%d{MM-dd HH:mm:ss}] %-5p %c{1} [%t]: %m%n"></PatternLayout>
        </Http>

和

 <AsyncRoot level="INFO">
            <AppenderRef ref="Splunk" ></AppenderRef>
        </AsyncRoot>

Answer 1

您看到的错误与将日志从 log4j2 发送到 Splunk 无关。您已按照标题为“使用 Anypoint Runtime Manager 在服务器组上启用 Splunk”下链接中的说明进行操作。本文的这一部分用于从应用程序内部通过运行时管理器代理将事件发送到 Splunk。这与日志记录完全分开。在运行时管理器中禁用 Splunk 事件跟踪，错误应该会消失。