技術標籤：logbackslf4jlog4j2

​最近查閱生產環境日誌後發現，有部分日誌在Kibana上查詢不到，所以登入到POD上檢查了下，發現日誌內容是這樣的：

{
"app":"insight",
"prdline":"risk-insight",
"timestamp":"2021-01-1410:46:22",
"log_level":"INFO",
"msg":"ServiceCallrequest[XXXX(userId:***,score:0,level:0,basic:{nickname=***,registration={"time":"1610592364"}},credit:null,growth:null,tag:null)]",
"stack_trace":""
}
 

在msg中的內容中包含了雙引號，所以json解析的時候失敗了，因此日誌也就沒辦法上傳到日誌平臺。

查閱logback配置：

<?xmlversion="1.0"encoding="UTF-8"?>
<configurationdebug="true">
<propertyname="LOG_LEVEL"value="INFO"/>
<appendername="STDOUT"class="ch.qos.logback.core.ConsoleAppender">
<encoderclass="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
<pattern>{"app":"XXX","prdline":"XXX","timestamp":"%date{yyyy-MM-ddHH:mm:ss}","log_level":"%level","msg":"%message","stack_trace":"%replace(%exception){'\n\s*','\\n'}%nopex"}%n</pattern>
</encoder>
</appender>

<appendername="ASYNC"class="ch.qos.logback.classic.AsyncAppender">
<neverBlock>true</neverBlock>
<discardingThreshold>0</discardingThreshold>
<queueSize>1024</queueSize>
<appender-refref="STDOUT"/>
</appender>

<rootlevel="${LOG_LEVEL}">
<appender-refref="ASYNC"/>
</root>
</configuration>
 

猜測如果列印日誌中包含雙引號，則"msg":"%message"會直接寫入到json中，由於雙引號沒轉義，日誌解析時就報錯了。

所以稍微調整下配置，對%message中的雙引號進行轉義應該就能解決問題：

<?xmlversion="1.0"encoding="UTF-8"?>
<configurationdebug="true">
<propertyname="LOG_LEVEL"value="INFO"/>
<appendername="STDOUT"class="ch.qos.logback.core.ConsoleAppender">
<encoderclass="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
<pattern>{"app":"XXX","prdline":"XXX","timestamp":"%date{yyyy-MM-ddHH:mm:ss}","log_level":"%level","msg":"%replace(%message){'"','\\"'}","stack_trace":"%replace(%exception){'\n\s*','\\n'}%nopex"}%n</pattern>
</encoder>
</appender>

<appendername="ASYNC"class="ch.qos.logback.classic.AsyncAppender">
<neverBlock>true</neverBlock>
<discardingThreshold>0</discardingThreshold>
<queueSize>1024</queueSize>
<appender-refref="STDOUT"/>
</appender>

<rootlevel="${LOG_LEVEL}">
<appender-refref="ASYNC"/>
</root>
</configuration>
 

釋出生產驗證，發現已經能在ELK上搜索到相關日誌了：