diff --git a/images/kibana.png b/images/kibana.png new file mode 100644 index 000000000..bc44a43f9 Binary files /dev/null and b/images/kibana.png differ diff --git a/spring-cloud-sleuth.html b/spring-cloud-sleuth.html index 4524080e5..873044348 100644 --- a/spring-cloud-sleuth.html +++ b/spring-cloud-sleuth.html @@ -597,7 +597,49 @@ service1.log:2016-02-26 11:15:48.182 INFO [service1,2485ec27856c56f4,2485ec2785
-

If you’re using a log aggregating tool like Kibana, Splunk etc. you can order the events that took place

+

If you’re using a log aggregating tool like Kibana, +Splunk etc. you can order the events that took place. An example of +Kibana would look like this:

+
+
+
+Log correlation with Kibana +
+
+
+

If you want to use Logstash here is the Grok pattern for Logstash:

+
+
+
+
filter {
+       # pattern matching logback pattern
+       grok {
+              match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span},%{DATA:exportable}\]\s+%{DATA:pid}---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:rest}" }
+       }
+}
+
+
+
+ + + + + +
+
Note
+		 +If you want to use Grok together with the logs from Cloud Foundry you have to use this pattern: +
+
+
+
+
filter {
+       # pattern matching logback pattern
+       grok {
+              match => { "message" => "(?m)OUT\s+%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span},%{DATA:exportable}\]\s+%{DATA:pid}---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:rest}" }
+       }
+}
+
@@ -1211,7 +1253,7 @@ the number of dropped spans will get increased.