title: Configuration ELK + log4j
body: <p>I installed ELK on a ubuntu server 14.04. And now I wanted to send to this all my jboss sever logs (using log4j).</p>
  
  <p>logstash configuration : 
  input conf file : </p>
  
  <pre><code>input {
      log4j {
          type =&gt; "log4j"
          port =&gt; 5000
      }
  }
  </code></pre>
  
  <p>filter conf file : </p>
  
  <pre><code>filter {
      if [type] == "log4j" {
          grok {
              match =&gt; {"message" =&gt; MY_GROK_PARSE}
          }
      }
  }
  </code></pre>
  
  <p>and the output file : </p>
  
  <pre><code>output {
      elasticsearch {
          embedded =&gt; true
      }
  }
  </code></pre>
  
  <p>And to finish the log4j appender:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;appender name="LOGSTASH" class="org.apache.log4j.net.SocketAppender"&gt; 
      &lt;param name="Port" value="5000"/&gt;
      &lt;param name="RemoteHost" value="XXX.XXX.XXX.XXX"/&gt; &lt;!-- There is a real adress here ;-) --&gt;
      &lt;param name="ReconnectionDelay" value="50000"/&gt; 
      &lt;param name="LocationInfo" value="true"/&gt; 
      &lt;layout class="org.apache.log4j.PatternLayout"&gt;
       &lt;param name="ConversionPattern" value="%d %-5p [%c{1}] %m%n" /&gt;
      &lt;/layout&gt;
  &lt;/appender&gt; 
  </code></pre>
  
  <p>But nothing happens with this configuration. So I don't know what I misunderstand.
  My other appenders (console and local file) work fine.
  The elasticsearch log show any information/activity.</p>
  
  <p><strong>Edit :</strong> 
  More about my jboss-log4j.xml:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;appender name="Async" class="org.apache.log4j.AsyncAppender"&gt;
      &lt;appender-ref ref="FILE" /&gt;
      &lt;appender-ref ref="CONSOLE" /&gt;
      &lt;appender-ref ref="LOGSTASH" /&gt;
  &lt;/appender&gt;
  
  &lt;root&gt;
      &lt;priority value="INFO" /&gt;
      &lt;appender-ref ref="Async" /&gt;
  &lt;/root&gt;
  </code></pre>