I have done a POC regarding Log management using ELK Stack.

I have converted pegarule.log to pegarules.JSON.log using JSONAppender in the server itself

I am using pega version 8.6 

In the server we have prlog4j2.xml i have added the given appender below pegarules.log

<RollingRandomAccessFile name="JSONAppender" fileName="${sys:pega.logdir}/PegaRULES.json.log" filePattern="${sys:pega.logdir}/PegaRULES-%d{MM-dd-yyyy}-%i.json.log.gz">   <LogStashJSONLayoutPega/>   <Filters>   <!--Deny message logged under ALERT log level-->   <ThresholdFilter level="ALERT" onMatch="DENY" onMismatch="NEUTRAL"/>   </Filters>   <Policies>   <TimeBasedTriggeringPolicy />   <SizeBasedTriggeringPolicy size="250 MB"/>   </Policies>   <DefaultRolloverStrategy max="20"/>   </RollingRandomAccessFile>

 Instead of using Logstash to process the logs i directly converted the logs to JSON (which is more readable) and stored in Elastic search.

Thanks,

Ajay Raghul.S