# Logstash Deprecation log JSON Format

**URL:** https://discuss.elastic.co/t/logstash-deprecation-log-json-format/303155
**Category:** Logstash
**Created:** [April 25, 2022, 11:36am UTC](https://discuss.elastic.co/t/logstash-deprecation-log-json-format/303155 "2022-04-25T11:36:07Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![hunsw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hunsw/32/93637_2.png) [@hunsw](https://discuss.elastic.co/u/hunsw)
#### Post date: [April 25, 2022, 11:36am UTC](https://discuss.elastic.co/t/logstash-deprecation-log-json-format/303155/1 "2022-04-25T11:36:07Z")

</div>

Is it possible to configure the deprecation logs of Logstash as JSON entries?

`log.format: json`  
works fine for the 'normal' logs, but not for deprecation ones. I've checked log4j2.properties and it seems that some kind of log4j magic could work(?)

I could not so far produce such a config, anyone else had or have a better idea?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 25, 2022, 6:19pm UTC](https://discuss.elastic.co/t/logstash-deprecation-log-json-format/303155/2 "2022-04-25T18:19:22Z")

</div>

Yes, you can configure this in log4j2.properties. Look at the first two appenders that are defined

```
appender.console.type = Console
appender.console.name = plain_console
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c]%notEmpty{[%X{pipeline.id}]}%notEmpty{[%X{plugin.id}]} %m%n

appender.json_console.type = Console
appender.json_console.name = json_console
appender.json_console.layout.type = JSONLayout
appender.json_console.layout.compact = true
appender.json_console.layout.eventEol = true

```

There two appenders are call plain\_console and json\_console. One of them is enabled by

```
rootLogger.appenderRef.console.ref = ${sys:ls.log.format}_console

```

which chooses between them using the log.format entry in logstash.yml.

This is not the default for the deprecation logs, which are enabled by

```
logger.deprecation.appenderRef.deprecation_rolling.ref = deprecation_plain_rolling

```

You could add another section to log4j2.properties to define a deprecation\_json\_rolling logger and then modify the appenderRef to use deprecation\_${sys:ls.log.format}\_rolling. (Obviously the rolling part is optional, and if you need it for deprecation logs... 🙂 )

---

<div class="post-metadata">

### Author: ![hunsw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hunsw/32/93637_2.png) [@hunsw](https://discuss.elastic.co/u/hunsw)
#### Post date: [April 27, 2022, 4:14pm UTC](https://discuss.elastic.co/t/logstash-deprecation-log-json-format/303155/3 "2022-04-27T16:14:08Z")

</div>

Thank you I will try your suggestions, knowing that it is doable is enough to spend a few minutes... hours... .... 🙂 on it!!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 25, 2022, 4:14pm UTC](https://discuss.elastic.co/t/logstash-deprecation-log-json-format/303155/4 "2022-05-25T16:14:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
