Using LogglyBufferringAppender does not parse log data

[talhaashfaque]

I am trying to use LogglyBufferringAppender with a bufferSize=2. It's posting the data to loggly. However, the logged data is not correctly parsed.

unparsed: message:["{\"timestamp\":\"2016-12-21T15:39:23.420+11:00\",\"level\":\"INFO\",\"hostName\":\"HostName\",\"process\":\"w3wp\",\"threadName\":\"11\",\"loggerName\":\"LoggerName\",\"message\":\"log message.\",\"IPAddress\":\"::1\",\"User_ID\":1,\"MaskedSessionID\":\"*****************\",\"User\":\"Mr. XXX for test test(57237)\"}","{\"timestamp\":\"2016-12-21T15:39:23.626+11:00\",\"level\":\"INFO\",\"hostName\":\"HostName\",\"process\":\"w3wp\",\"threadName\":\"11\",\"loggerName\":\"LoggerName\",\"message\":\"log message.\",\"IPAddress\":\"::1\",\"User_ID\":1,\"MaskedSessionID\":\"*****************\",\"User\":\"Mr. XXX for test test(57237)\"}","{\"timestamp\":\"2016-12-21T15:39:34.684+11:00\",\"level\":\"INFO\",\"hostName\":\"HostName\",\"process\":\"w3wp\",\"threadName\":\"11\",\"loggerName\":\"LoggerName\",\"message\":\"log message.\",\"IPAddress\":\"::1\",\"User_ID\":1,\"MaskedSessionID\":\"*****************\",\"User\":\"Mr. XXX for test test(57237)\"}"]

I have been using LogglyAppender with no issue. The reason to use LogglyBufferringAppender is to decrease the network traffic and log 2 entries in a go.

[varshneyjayant]

@talhaashfaque I am expecting you are seeing one event as multiple events in Loggly dashboard. This is because loggly bulk splits the events using comma. If you send plain text events instead of JSON, separated by comma, it will work fine.

@Shwetajain148 could you please look into this?

[talhaashfaque]

@varshneyjayant - thanks for the quick response.

It works fine if I use the following on config:
<appender name="LogglyAppender" type="log4net.loggly.LogglyAppender, log4net-loggly">

Then the message in loggly looks like:

json:

threadName: 16
User_ID: 1
level: INFO
process: w3wp
timestamp: 2016-12-22T17:57:55.501+00:00
hostName: HostName
loggerName: Logger.NameSpace
User: Mr. XXX
message: Log message.
IPAddress: 127.0.0.1
MaskedSessionID: *****************

Raw Message:
{"timestamp":"2016-12-22T17:57:55.501+00:00","level":"INFO","hostName":"HostName","process":"w3wp","threadName":"16","loggerName":"Logger.NameSpace","message":"Log message.","IPAddress":"127.0.0.1","User_ID":1,"MaskedSessionID":"*****************","User":"Mr. XXX"}

The issue occurs when I change the appender type in the config from LogglyAppender to LogglyBufferringAppender.

<appender name="LogglyAppender" type="log4net.loggly.LogglyBufferringAppender, log4net-loggly">

Changing the appender type loses the formatting of the log message.

[talhaashfaque]

The main reason I am trying to use LogglyBufferringAppender is to decrease the network traffic by logging X number of logs in a go.

I had a quick look at the source code:
https://github.com/varshneyjayant/log4net-loggly/commit/6e01fe0a8acfe6431fae7b211b7168348736e69a#diff-426e7d1bfe3d4bd5ab57489f273c2d3dR88
Seems that it might actually do buffering in the non-buffering appender.
if (Config.LogMode == "bulk/")
rather than inputs/
and it might already be doing 100 logs at a time - iff which should be the default.

but that trailing slash looks a little odd to me...
https://github.com/varshneyjayant/log4net-loggly/search?utf8=%E2%9C%93&q=bulk

Kindly confirm if using the bulk mode help me achieve in decreasing the network traffic?