I’m working on a logging encoder plugin, that makes it easier to use Caddy if Elastic Stack Filebeat is used to collect and ship logs.
https://www.elastic.co/guide/en/ecs/current/index.html
{"level":"info","ts":1645912920.7716858,"msg":"using provided configuration","config_file":"/etc/caddy/Caddyfile","config_adapter":""}
I can’t get my encoder to “encode” this particular initial message, but any other log lines gets “touched” by my plugin.
The problem is that my filebeat collects and ships this message, and wrecks all sorts of havoc in my elastic stack setup.
I could create an elasticsearch ingestion pipeline supporting caddys json structure, but I would much rather like Caddy to print ECS compatible json lines.
Here is the plugin
https://github.com/firecow/caddy-elastic-encoder
Here is how the logs looks like, except the one in question.
{"log.level":"info","@timestamp":"2022-02-27T13:15:51.055Z","log.logger":"admin","message":"admin endpoint started","address":"tcp/localhost:2019","enforce_origin":false,"origins":["localhost:2019","[::1]:2019","127.0.0.1:2019"]}
{"log.level":"info","@timestamp":"2022-02-27T13:15:51.055Z","message":"autosaved config (load with --resume flag)","file":"/tmp/caddy/autosave.json"}
{"log.level":"info","@timestamp":"2022-02-27T13:15:51.055Z","message":"serving initial configuration"}
Anyone got any ideas on how to suppress this initial log message, that doesn’t get encoded by plugins, or how i get my plugin to catch em?