log4j.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE log4j:configuration SYSTEM "log4j.dtd">

<log4j:configuration xmlns:log4j="http://jakarta.apache.org/log4j/" debug="false">


    <appender name="logstash" class="org.apache.log4j.net.SocketAppender">
        <param name="Port" value="9527"/>
        <param name="RemoteHost" value="127.0.0.1"/>
    </appender>

    <!-- Prevent blocking when something goes wrong -->
    <appender name="asyncLogstash" class="org.apache.log4j.AsyncAppender">
        <param name="BufferSize" value="20"/>
        <param name="Blocking" value="false"/>
        <appender-ref ref="logstash"/>
    </appender>

    <logger name="error">
        <level value="ERROR"/>
        <appender-ref ref="asyncLogstash"/>
    </logger>


</log4j:configuration>

logstash.conf

input {
  log4j {
    mode => "server"
    host => "127.0.0.1"
    port => 9527
    type => "log4j"
  }
}
output {
  elasticsearch {
    protocol => "http"
    host => "192.168.201.37"
    port => 9200
  }
}