I have done a POC regarding Log management using ELK Stack.
I have converted pegarule.log to pegarules.JSON.log using JSONAppender in the server itself
I am using pega version 8.6
In the server we have prlog4j2.xml i have added the given appender below pegarules.log
**<ThresholdFilter level="ALERT" onMatch="DENY" onMismatch="NEUTRAL"/>**
<strong>
</Filters></strong>
<strong>
<Policies></strong>
<strong>
<TimeBasedTriggeringPolicy /></strong>
<strong>
<SizeBasedTriggeringPolicy size="250 MB"/></strong>
<strong>
</Policies></strong>
<strong>
<DefaultRolloverStrategy max="20"/></strong>
<strong>
</RollingRandomAccessFile></strong>
Instead of using Logstash to process the logs i directly converted the logs to JSON (which is more readable) and stored in Elastic search.
Thanks,
Ajay Raghul.S