Howto put your symfony logs into ELK with filebeat

TL;DR

Log messages in your symfony app with fields in the logging context and make them available in Kibana for reporting.

  • write logfiles logstash formated into a file
  • use filebeat to transfer them logstash
  • post process them with logstash
  • put them in elasticsearch to view them with kibana

logging in symfony controller

$logger = $this->get('monolog.logger.elk');
$logger->info(‘niepi.someMessage’, ['value1' => $value1, 'value2’ => $value2]);

logger config (app/config/config.yml)

monolog:
	channels: [ "elk"]
…
kibana:
	type:stream
	path:"%kernel.logs_dir%/elk.log"
	formatter: service.elkformater
	action_level: info
	channels: ["elk"]

formater config (src/AppBundle/Resources/config/services.yml)

service.elkformater:
	class: Monolog\Formatter\LogstashFormatter
	arguments:
		- 'appName'
		- ~
		- ~
		- ~
		- 1

filebeat config (/etc/filebeat/filebeat.yml)

…
filebeat:
	prospectors:
		-
		 paths:
			- “/%APP_LOCATION%/app/logs/elk.log"
		 document_type: application # this is just an identifier for logstash

Logstash config

filter {
	if [type] == "application" {
		json{
			source => "message"
		}
	}
}