JarCastingDeprecation notice
This project has been deprecated as of 2018-01-16 and will not be maintained anymore.
If you're looking for a GELF appender for Log4j 2, we recommend using logstash-gelf by Mark Paluch.
GELF Appender for Apache Log4j 2
This appender for Apache Log4j 2 logs messages to a GELF server like Graylog or logstash.
It's using the official GELF Java client to connect to a remote server.
You can specify the following parameters for the GELF appender in the log4j2.xml configuration file:
name- The reference name of the Appender
server(default:localhost)- The host name or IP address of the GELF server
port(default:12201)- The port the GELF server is listening on
hostName(default: the local host name orlocalhostif it couldn't be detected)- The host name of the machine generating the logs
protocol(default:UDP)- The transport protocol to use
tlsEnabled(default:false)- Whether TLS should be enabled
tlsEnableCertificateVerification(default:true)- Whether the TLS certificate chain should be checked
tlsTrustCertChainFilename(default: empty)- A X.509 certificate chain file in PEM format for certificate verification
includeSource(default:true)- Whether the source of the log message should be included
includeThreadContext(default:true)- Whether the contents of the ThreadContext should be included
includeStackTrace(default:true)- Whether a full stack trace should be included
includeExceptionCause(default:false)- Whether the included stack trace should contain causing exceptions
queueSize(default:512)- The size of the internally used queue
connectTimeout(default:1000)- The connection timeout for TCP connections in milliseconds
reconnectDelay(default:500)- The time to wait between reconnects in milliseconds
sendBufferSize(default:-1)- The size of the socket send buffer in bytes. A size of -1 deactivates the send buffer
tcpNoDelay(default:false)- Whether Nagle's algorithm should be used for TCP connections
tcpKeepAlive(default:false)- Whether to try keeping alive TCP connections.
Filterelements- A Filter to determine if the event should be handled by this Appender
Layoutelement (default: none)- The Layout used to format the LogEvent
ignoreExceptions- The default is
true, causing exceptions encountered while appending events to be internally logged and then ignored. When set tofalseexceptions will be propagated to the caller, instead. Must be set tofalsewhen wrapping this Appender in aFailoverAppender.
- The default is
- Additional Fields
- Additional fields can be added with
KeyValuePairelements inside theGELFelement.
- Additional fields can be added with
log4j2.xml example
<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="OFF" packages="org.graylog2.log4j2">
<Appenders>
<GELF name="gelfAppender" server="graylog2.example.com" port="12201" hostName="appserver01.example.com">
<PatternLayout pattern="%logger{36} - %msg%n"/>
<Filters>
<Filter type="MarkerFilter" marker="FLOW" onMatch="DENY" onMismatch="NEUTRAL"/>
<Filter type="MarkerFilter" marker="EXCEPTION" onMatch="DENY" onMismatch="ACCEPT"/>
</Filters>
<!-- Additional fields -->
<KeyValuePair key="foo" value="bar"/>
<KeyValuePair key="jvm" value="${java:vm}"/>
</GELF>
</Appenders>
<Loggers>
<Root level="info">
<AppenderRef ref="gelfAppender"/>
</Root>
</Loggers>
</Configuration>
Java code example
Logger logger = LogManager.getLogger("test");
ThreadContext.put("userId", "testUser");
logger.info("Hello World");
Using variables in the additional fields
The additional fields (KeyValuePair elements) can contain references to variables.
In order for Log4j 2.x to resolve the variable's value, the variable name must have a certain prefix depending on how the variable is provided.
Internally we're making use of Log4j's StrSubstitutor to resolve the variable's value.
This in turn is utilizing the following Log4j Lookups with the prefixes in the following list:
| Prefix | Documentation |
|---|---|
ctx |
ContextMapLookup |
bundle |
ResourceBundleLookup |
date |
DateLookup |
env |
EnvironmentLookup |
java |
JavaLookup |
jndi |
JndiLookup |
jvmrunargs |
JmxRuntimeInputArgumentsLookup |
map |
MapLookup |
sd |
StructuredDataLookup |
sys |
SystemPropertiesLookup |
Please read up on the different variable handling in the linked Javadocs.
Example configuration with variables
<GELF name="gelfAppender" server="graylog2.example.com" port="12201" hostName="appserver01.example.com">
<KeyValuePair key="user" value="${env:USER}"/>
<KeyValuePair key="CLIargument" value="${sys:cliargument}"/>
<KeyValuePair key="jvm" value="${java:vm}"/>
<KeyValuePair key="fileEncoding" value="${sys:file.encoding}"/>
</GELF>
Versions
| GELF Appender for Apache Log4j 2 | Release date |
|---|---|
| 1.0.0 | 29-Sep-2014 |
| 1.0.1 | 21-Oct-2014 |
| 1.0.2 | 09-Feb-2015 |
| 1.0.3 | 11-Feb-2015 |
| 1.1.0 | 16-Jul-2015 |
| 1.2.0 | 18-Jul-2016 |
| 1.2.1 | 11-Aug-2016 |
| 1.3.0 | 24-Aug-2016 |
| 1.3.1 | 22-Oct-2016 |
This appender uses GELF Java client 1.4.1.
Installation
Maven coordinates
<dependencies>
<dependency>
<groupId>org.graylog2.log4j2</groupId>
<artifactId>log4j2-gelf</artifactId>
<version>1.3.1</version>
</dependency>
</dependencies>
License
GELF Appender for Apache Log4j 2
Copyright (C) 2014 TORCH GmbH; 2015-2018 Graylog, Inc.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
