log4j ----->flume

通过log4j \log4j2传输 json到 flume1.7

方式一:使用avro + flume-ng-log4jappender + 重写appender

      log4j.appender.flume=com.log.SubLog4jAppender 
      message和stackTrace 以及自定字段 hostName----->封装json数据----->
      flumeEvent = EventBuilder.withBody(msg, Charset.forName("UTF8"), hdrs);


方式二:使用tcp +logststash-gelf + flume源码SystemLogUtil

            logststash-gelf 的\u0000刚好替换掉 flume tcp的 \n (大小可能有其他影响)

方式三:取用logststash-gelf的构造JSON其他同[方式一]相同

[方式二]有重连，[方式一]+[方式三]的重连问题 https://issues.apache.org/jira/browse/FLUME-2186

log4j2 

org.apache.logging.log4j.core.layout

public byte[] toByteArray(LogEvent event) {
    byte[] bytes = this.getBytes(this.toSerializable(event));
    return bytes;
   // return bytes.length > this.compressionThreshold?this.compress(bytes):bytes;
}

com.log2.GelfLayout2

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="WARN" monitorInterval="300"  packages="com.log2">
<Appenders>
    <Console name="Console" target="SYSTEM_OUT">
        <PatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"/>
    </Console>
    <Flume name="eventLogger" compress="false">
        <Agent host="192.168.56.103" port="6666"/>
        <GelfLayout2/>
    </Flume>
</Appenders>
<Loggers>
    <Root level="ERROR">
        <AppenderRef ref="eventLogger" />
        <AppenderRef ref="Console"/>
    </Root>
</Loggers>
</Configuration>