Appender 2.x ‐ Log4j 2.x

Configuration

In the configuration file, add a new appender ElasticsearchAppender using package com.chavaillaz.appender.log4j with the following properties:

• ApplicationName (default unknown). It can also be specified as environment variable or system property APPLICATION.
• HostName (default is the machine host name). It can also be specified as environment variable or system property HOST.
• EnvironmentName (default local). It can be specified also as environment variable or system property ENV.
• ElasticConverter (default com.chavaillaz.appender.log4j.converter.DefaultEventConverter) is the class used to convert a logging event into a key/value document to be stored in Elasticsearch. It can also be specified as environment variable or system property CONVERTER.
• ElasticIndex (default ha) and ElasticIndexSuffix (default -yyyy.MM.dd) form together the index name where the messages are sent to. Note that ElasticIndexSuffix must contain a format pattern suitable for DateTimeFormatter. They can also both be specified with environment variables or system properties INDEX and INDEX_SUFFIX.
• ElasticUrl is the address of the server (or its load balancer) in the format [scheme://][host]:[port]. The scheme is optional and defaults to http.
• ElasticApiKey (encoded) or ElasticUser with ElasticPassword are the credentials for the server.
• ElasticParallelExecution (default true) specifies the way the messages are sent to the server (true send them in a separate thread and false send them sequentially).
• ElasticBatchSize (default 1) is the number of messages threshold triggering the sending to the server.
• ElasticBatchInitialDelay (default 1000) is the time in milliseconds before a first batch of messages is sent to the server (after appender startup, even if the batch of messages is incomplete, meaning not reaching the threshold).
• ElasticBatchDelay (default 1000) is the time in milliseconds between two cleanups of incomplete batches. If after this time there are less than elasticBatchSize messages waiting to be sent, the batch is sent nonetheless. Note that once ElasticBatchSize messages are waiting, the batch is sent immediately, without any delay.

Note that ElasticUrl is the only mandatory configuration to give, except if you need to overwrite the default value of another ones.

XML file example

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="info" packages="com.chavaillaz.appender.log4j">
    <Appenders>
        <Console name="Console" target="SYSTEM_OUT">
            <PatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"/>
        </Console>
        <ElasticsearchAppender name="Elasticsearch">
            <PatternLayout pattern="%msg"/>
            <ApplicationName>myApplication</ApplicationName>
            <EnvironmentName>local</EnvironmentName>
            <ElasticConverter>com.chavaillaz.appender.log4j.converter.DefaultEventConverter</ElasticConverter>
            <ElasticUrl>http://localhost:9300</ElasticUrl>
            <ElasticIndex>ha</ElasticIndex>
            <ElasticIndexSuffix>-yyyy.MM.dd</ElasticIndexSuffix>
            <ElasticUser>elastic</ElasticUser>
            <ElasticPassword>changeme</ElasticPassword>
            <ElasticParallelExecution>true</ElasticParallelExecution>
            <ElasticBatchSize>10</ElasticBatchSize>
            <ElasticBatchInitialDelay>1000</ElasticBatchInitialDelay>
            <ElasticBatchDelay>1000</ElasticBatchDelay>
        </ElasticsearchAppender>
    </Appenders>
    <Loggers>
        <Root level="info">
            <AppenderRef ref="Console"/>
            <AppenderRef ref="Elasticsearch" additivity="false"/>
        </Root>
    </Loggers>
</Configuration>