Blog article on monolog to ELK #blog

index.php

<?php

require('../vendor/autoload.php');

use Monolog\Logger;
use Monolog\Handler\SocketHandler;

// create a log channel
$log = new Logger('elk');

// "logstash" is a host defined by docker-compose
$handler = new SocketHandler('logstash:9001', Logger::DEBUG);
$log->pushHandler($handler);

logstash.conf

input {
    tcp {
        port => 9001
    }
}

# See https://grokdebug.herokuapp.com/ and https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns
filter {
    grok {
        match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:env}\.%{DATA:severity}: %{GREEDYDATA:message} (?<context>(\{.*?\})) \[\]" }
    }
}

filter {
    json {
        source => "context"
    }
}

output {
    stdout {}
}