Logstash Deprecation log JSON Format

[hunsw (Attila)]

Is it possible to configure the deprecation logs of Logstash as JSON entries?

log.format: json
works fine for the 'normal' logs, but not for deprecation ones. I've checked log4j2.properties and it seems that some kind of log4j magic could work(?)

I could not so far produce such a config, anyone else had or have a better idea?

[Badger]

Yes, you can configure this in log4j2.properties. Look at the first two appenders that are defined

appender.console.type = Console
appender.console.name = plain_console
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c]%notEmpty{[%X{pipeline.id}]}%notEmpty{[%X{plugin.id}]} %m%n

appender.json_console.type = Console
appender.json_console.name = json_console
appender.json_console.layout.type = JSONLayout
appender.json_console.layout.compact = true
appender.json_console.layout.eventEol = true

There two appenders are call plain_console and json_console. One of them is enabled by

rootLogger.appenderRef.console.ref = ${sys:ls.log.format}_console

which chooses between them using the log.format entry in logstash.yml.

This is not the default for the deprecation logs, which are enabled by

logger.deprecation.appenderRef.deprecation_rolling.ref = deprecation_plain_rolling

You could add another section to log4j2.properties to define a deprecation_json_rolling logger and then modify the appenderRef to use deprecation_${sys:ls.log.format}_rolling. (Obviously the rolling part is optional, and if you need it for deprecation logs... )

[hunsw (Attila)]

Thank you I will try your suggestions, knowing that it is doable is enough to spend a few minutes... hours... .... on it!!