如何使用Log4j日志？

日志服务支持通过以下方式采集log4j日志：

• Loghub Log4j Appender
• Logtail

通过Loghub Log4j Appender采集Log4j日志


详细内容及采集步骤请参考 Log4j Appender。

通过Logtail采集Log4j日志


Log4j日志分第一代和第二代，本文档以第一代的默认配置为例，讲述如何配置正则式，如果采用Log4j 2，需要修改默认配置，把日期完整打印出来。

1. [backcolor=transparent]<Configuration[backcolor=transparent] [backcolor=transparent]status[backcolor=transparent]=[backcolor=transparent]"WARN"[backcolor=transparent]>
2. [backcolor=transparent]  [backcolor=transparent]<Appenders>
3. [backcolor=transparent]    [backcolor=transparent]<Console[backcolor=transparent] [backcolor=transparent]name[backcolor=transparent]=[backcolor=transparent]"Console"[backcolor=transparent] [backcolor=transparent]target[backcolor=transparent]=[backcolor=transparent]"SYSTEM_OUT"[backcolor=transparent]>
4. [backcolor=transparent]      [backcolor=transparent]<PatternLayout[backcolor=transparent] [backcolor=transparent]pattern[backcolor=transparent]=[backcolor=transparent]"%d{yyyy-MM-dd HH:mm:ss:SSS zzz} [%t] %-5level %logger{36} - %msg%n"[backcolor=transparent]/>
5. [backcolor=transparent]    [backcolor=transparent]</Console>
6. [backcolor=transparent]  [backcolor=transparent]</Appenders>
7. [backcolor=transparent]  [backcolor=transparent]<Loggers>
8. [backcolor=transparent]    [backcolor=transparent]<Logger[backcolor=transparent] [backcolor=transparent]name[backcolor=transparent]=[backcolor=transparent]"com.foo.Bar"[backcolor=transparent] [backcolor=transparent]level[backcolor=transparent]=[backcolor=transparent]"trace"[backcolor=transparent]>
9. [backcolor=transparent]      [backcolor=transparent]<AppenderRef[backcolor=transparent] [backcolor=transparent]ref[backcolor=transparent]=[backcolor=transparent]"Console"[backcolor=transparent]/>
10. [backcolor=transparent]    [backcolor=transparent]</Logger>
11. [backcolor=transparent]    [backcolor=transparent]<Root[backcolor=transparent] [backcolor=transparent]level[backcolor=transparent]=[backcolor=transparent]"error"[backcolor=transparent]>
12. [backcolor=transparent]      [backcolor=transparent]<AppenderRef[backcolor=transparent] [backcolor=transparent]ref[backcolor=transparent]=[backcolor=transparent]"Console"[backcolor=transparent]/>
13. [backcolor=transparent]    [backcolor=transparent]</Root>
14. [backcolor=transparent]  [backcolor=transparent]</Loggers>
15. [backcolor=transparent]</Configuration>

配置Logtail收集Python日志的详细操作步骤请参考 快速入门和 Apache日志，根据您的网络部署和实际情况选择对应配置。
在生成正则式的部分，由于自动生成的正则式只参考了日志样例，无法覆盖所有的日志情况，所以需要用户在自动生成之后做一些微调。
Log4j 默认日志格式打印到文件中的日志样例如下：

1. [backcolor=transparent]2013[backcolor=transparent]-[backcolor=transparent]12[backcolor=transparent]-[backcolor=transparent]25[backcolor=transparent] [backcolor=transparent]19[backcolor=transparent]:[backcolor=transparent]57[backcolor=transparent]:[backcolor=transparent]06[backcolor=transparent],[backcolor=transparent]954[backcolor=transparent] [backcolor=transparent][[backcolor=transparent]10.207[backcolor=transparent].[backcolor=transparent]37.161[backcolor=transparent]][backcolor=transparent] WARN impl[backcolor=transparent].[backcolor=transparent]PermanentTairDaoImpl[backcolor=transparent] [backcolor=transparent]-[backcolor=transparent] [backcolor=transparent]Fail[backcolor=transparent] to [backcolor=transparent]Read[backcolor=transparent] [backcolor=transparent]Permanent[backcolor=transparent] [backcolor=transparent]Tair[backcolor=transparent],[backcolor=transparent]key[backcolor=transparent]:[backcolor=transparent]e[backcolor=transparent]:[backcolor=transparent]470217319319741[backcolor=transparent]_1[backcolor=transparent],[backcolor=transparent]result[backcolor=transparent]:[backcolor=transparent]com[backcolor=transparent].[backcolor=transparent]example[backcolor=transparent].[backcolor=transparent]tair[backcolor=transparent].[backcolor=transparent]Result@172e3ebc[backcolor=transparent][[backcolor=transparent]rc[backcolor=transparent]=[backcolor=transparent]code[backcolor=transparent]=-[backcolor=transparent]1[backcolor=transparent],[backcolor=transparent] msg[backcolor=transparent]=[backcolor=transparent]connection error [backcolor=transparent]or[backcolor=transparent] timeout[backcolor=transparent],[backcolor=transparent]value[backcolor=transparent]=,[backcolor=transparent]flag[backcolor=transparent]=[backcolor=transparent]0[backcolor=transparent]]

多行日志起始匹配（使用IP信息表示一行开头）：

1. [backcolor=transparent]\d[backcolor=transparent]+-[backcolor=transparent]\d[backcolor=transparent]+-[backcolor=transparent]\d[backcolor=transparent]+[backcolor=transparent]\s[backcolor=transparent].*

提取日志信息的正则表达式：

1. [backcolor=transparent]([backcolor=transparent]\d[backcolor=transparent]+-[backcolor=transparent]\d[backcolor=transparent]+-[backcolor=transparent]\d[backcolor=transparent]+[backcolor=transparent]\s\d[backcolor=transparent]+:[backcolor=transparent]\d[backcolor=transparent]+:[backcolor=transparent]\d[backcolor=transparent]+,[backcolor=transparent]\d[backcolor=transparent]+)[backcolor=transparent]\s\[[backcolor=transparent]([^[backcolor=transparent]\][backcolor=transparent]]*)[backcolor=transparent]\]\s[backcolor=transparent]([backcolor=transparent]\S[backcolor=transparent]+)[backcolor=transparent]\s[backcolor=transparent]+([backcolor=transparent]\S[backcolor=transparent]+)[backcolor=transparent]\s[backcolor=transparent]-[backcolor=transparent]\s[backcolor=transparent](.*)

时间转换格式：

1. [backcolor=transparent]%[backcolor=transparent]Y[backcolor=transparent]-%[backcolor=transparent]m[backcolor=transparent]-%[backcolor=transparent]d [backcolor=transparent]%[backcolor=transparent]H[backcolor=transparent]:%[backcolor=transparent]M[backcolor=transparent]:%[backcolor=transparent]S

样例日志提取结果：

Key	Value
time	2013-12-25 19:57:06,954
ip	10.207.37.161
level	WARN
class	impl.PermanentTairDaoImpl

[tr=rgb(239, 251, 255)][td]message Fail to Read Permanent Tair,key:e:470217319319741_1,result:com.example.tair.Result@172e3ebc[rc=code=-1, msg=connection error or timeout,value=,flag=0]