Howto put your symfony logs into ELK with filebeat

TL;DR

Log messages in your symfony app with fields in the logging context and make them available in Kibana for reporting.

  • write logfiles logstash formated into a file
  • use filebeat to transfer them logstash
  • post process them with logstash
  • put them in elasticsearch to view them with kibana 

logging in symfony controller

$logger = $this->get('monolog.logger.elk');
$logger->info(‘niepi.someMessage’, ['value1' => $value1, 'value2’ => $value2]);

logger config (app/config/config.yml)

monolog:
    channels: [ "elk"]

kibana:
    type:stream
    path:"%kernel.logs_dir%/elk.log"
    formatter: service.elkformater
    action_level: info
    channels: ["elk"]

formater config (src/AppBundle/Resources/config/services.yml)

service.elkformater:
    class: Monolog\Formatter\LogstashFormatter
    arguments:
        - 'appName'
        - ~
        - ~
        - ~
        - 1

filebeat config (/etc/filebeat/filebeat.yml)


filebeat:
    prospectors:
        -
         paths:
            - /%APP_LOCATION%/app/logs/elk.log"
         document_type: application # this is just an identifier for logstash

Logstash config

filter {
    if [type] == "application" {
        json{
            source => "message"
        }
    }
}