Thanks a lot for your answer Chris > > I am trying to forward the logs generated on a server to a > > centralized log collector (using rsyslog), one of the features I > > would like to use the ability to group messages by using their > > timestamp as the start of the message. By reading the documentation > > at https://tomcat.apache.org/tomcat-9.0-doc/logging.html#Console, I > > can't see the proper way to get a common format (preferably with > > timestamp), or ar tleast save the outputs into three different > > types in different files? > > I think you are being confused by the fact that the default log > pattern contains a newline character. For example, these are the first > two entries in my local catalina.out file: > > Apr 12, 2019 1:55:03 PM org.apache.coyote.AbstractProtocol init > INFO: Initializing ProtocolHandler ["ajp-nio-8215"] > Apr 12, 2019 1:55:03 PM org.apache.tomcat.util.net.NioSelectorPool > getSharedSelector > INFO: Using a shared selector for servlet write/read > Apr 12, 2019 1:55:03 PM org.apache.coyote.AbstractProtocol init > > (Apologies for the word-wrapping) > > The first entry is [Apr 12, 2019 1:55:03 PM] and the text ends with > ["ajp-nio-8215"] > > The second entry has the same timestmp and the text ends with > "AbstractProtocol init" > > Stack traces are always impossible to handle when looking at the > resulting file, since they almost always span multiple lines of text > - -- that is, they have embedded newlines in the message. > > Are you asking about how to make sense of the log file, how to send > log messages to a central server, or how to coalesce log messages by > timestamp? >
Rsyslog allows to read multiline messages by matching a regular expression (see https://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html#startmsg-regex), this allow the messages to be forwarded to a third party (graylog, logstash, ..) as a a single message. So my intention would be to be able to make all the messages to start with a timestamp (or a defined format) After your message I undertand that this is a single message (I didn't realize it) and all the messages in catalina.out are obeying the same format. Being the next lines a single message, am I right? 19-May-2019 06:25:20.937 INFO [localhost-startStop-1] > org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned > for TLDs yet contained no TLDs. Enable debug logging for this logger for a > comple > te list of JARs that were scanned but no TLDs were found in them. Skipping > unneeded JARs during scanning can improve startup time and JSP compilation > time. > [ERROR] Unable to find config file. Creating new servlet engine config > file: /WEB-INF/server-config.wsdd > [WARN] Web application uses > org.apache.axis2.transport.http.AxisAdminServlet; please update web.xml to > use org.apache.axis2.webapp.AxisAdminServlet instead > [WARN] Unable to load manifest for StAX implementation at jrt:/java.xml/ > [INFO] Clustering has been disabled > Thanks, Joan > >
