According to similar topic:
you cannot have more than one log4j config file.
otherwise you'd need a dedicated log file per plugin.
However, according to docs, X-Pack plugin has exactly that:
You configure also configure how the logfile is written in the
log4j2.propertiesfile located in
(Btw, there is a typo: "configure" instead of "can" )
So, X-Pack does have a separate logging file for its audit log.
- How does it loaded?
- Is there a way to configure my plugin to have a separate log? I've tried to create a
CONFIG_DIR/<plugin-name>but that did not work.
Digging into docs i found that:
Multiple configuration files can be loaded (in which case they will get merged) as long as they are named
log4j2.propertiesand have the Elasticsearch config directory as an ancestor; this is useful for plugins that expose additional loggers. The logger section contains the java packages and their corresponding log level. The appender section contains the destinations for the logs. Extensive information on how to customize logging and all the supported appenders can be found on the Log4j documentation.
Maybe there is some problem with my installation then.
The root of my configuration is
I have two instances of it, so their configurations stored in
/etc/elasticsearch/instance2. If I place a
log4j2.properties file to any subfolder of instance folder, it works fine. But x-pack plugin config is installed to
/etc/elasticsearch/x-pack/log4j2.properties is not being loaded. How can I properly fix this?
For now, I've just created two symlinks.
Probably related issue: https://github.com/elastic/puppet-elasticsearch/issues/226