Skip to content

Commit 35f75ec

Browse files
committed
Merge from upstream/master
2 parents c7c25e3 + 4a805a3 commit 35f75ec

File tree

54 files changed

+2267
-784
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+2267
-784
lines changed

.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
11
target
22
.idea
33
**.iml
4+
5+
# Local doc build files
6+
html_docs

README.md

Lines changed: 10 additions & 172 deletions
Original file line numberDiff line numberDiff line change
@@ -7,185 +7,23 @@ Centralized logging for Java applications with the Elastic stack made easy
77

88
---
99

10-
**Please note** that this library is in a **beta** version and backwards-incompatible changes might be introduced in future releases while the major version is zero (0.x.x).
10+
**Please note** This library is in **beta**. Backward-incompatible changes might be introduced in future releases while the major version is zero (0.x.x).
1111

1212
---
1313

14-
<img width="1829" alt="logs-ui" src="https://user-images.githubusercontent.com/2163464/62682932-9cac3600-b9bd-11e9-9cc3-39e907280f8e.png">
14+
## Release announcements
1515

16-
## What is ECS?
16+
To get notified about new releases, watch this repository for `Releases only`.
1717

18-
Elastic Common Schema (ECS) defines a common set of fields for ingesting data into Elasticsearch.
19-
For more information about ECS, visit the [ECS Reference Documentation](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html).
18+
## Getting Help
2019

21-
## What is ECS logging?
20+
If you need help or hit an issue, please start by opening a topic on our [discuss forums](https://discuss.elastic.co/c/observability/logs/69).
21+
Please note that we reserve GitHub tickets for confirmed bugs and enhancement requests.
2222

23-
This library helps to log ECS-compatible JSON into a file
23+
## Documentation
2424

25-
Example:
26-
```
27-
{"@timestamp":"2019-08-06T12:09:12.375Z", "log.level": "INFO", "message":"Tomcat started on port(s): 8080 (http) with context path ''", "service.name":"spring-petclinic","process.thread.name":"restartedMain","log.logger":"org.springframework.boot.web.embedded.tomcat.TomcatWebServer"}
28-
{"@timestamp":"2019-08-06T12:09:12.379Z", "log.level": "INFO", "message":"Started PetClinicApplication in 7.095 seconds (JVM running for 9.082)", "service.name":"spring-petclinic","process.thread.name":"restartedMain","log.logger":"org.springframework.samples.petclinic.PetClinicApplication"}
29-
{"@timestamp":"2019-08-06T14:08:40.199Z", "log.level":"DEBUG", "message":"init find form", "service.name":"spring-petclinic","process.thread.name":"http-nio-8080-exec-8","log.logger":"org.springframework.samples.petclinic.owner.OwnerController","transaction.id":"28b7fb8d5aba51f1","trace.id":"2869b25b5469590610fea49ac04af7da"}
30-
{"@timestamp":"2019-09-17T13:16:48.038Z", "log.level":"ERROR", "message":"Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is java.lang.RuntimeException: Expected: controller used to showcase what happens when an exception is thrown] with root cause", "process.thread.name":"http-nio-8080-exec-1","log.logger":"org.apache.catalina.core.ContainerBase.[Tomcat].[localhost].[/].[dispatcherServlet]","log.origin":{"file.name":"DirectJDKLog.java","function":"log","file.line":175},"error.type":"java.lang.RuntimeException","error.message":"Expected: controller used to showcase what happens when an exception is thrown","error.stack_trace":[
31-
"java.lang.RuntimeException: Expected: controller used to showcase what happens when an exception is thrown",
32-
"\tat org.springframework.samples.petclinic.system.CrashController.triggerException(CrashController.java:33)",
33-
"\tat sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)",
34-
"\tat sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)",
35-
"\tat sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)",
36-
"\tat java.lang.reflect.Method.invoke(Method.java:498)",
37-
"\tat org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)",
38-
"\tat java.lang.Thread.run(Thread.java:748)"]}
39-
```
25+
Docs are located on [elastic.co](https://www.elastic.co/guide/en/ecs-logging/java/current/index.html).
4026

41-
## Why ECS logging?
27+
## License
4228

43-
* No parsing of the log file required \
44-
Logging in ECS-compatible JSON has the advantage that you don't need to set up a logstash/ingest node pipeline to parse logs using grok.
45-
* No external dependencies
46-
* Highly efficient by manually serializing JSON
47-
* Low/Zero allocations (reduces GC pauses) \
48-
The log4j2 `EcsLayout` does not allocate any memory (unless the log event contains an `Exception`)
49-
* Decently human-readable JSON structure \
50-
The first three fields are always `@timestamp`, `log.level` and `message`.
51-
It's also possible to format stack traces so that each element is rendered in a new line.
52-
* Use the Kibana [Logs UI](https://www.elastic.co/guide/en/kibana/7.3/xpack-logs.html) without additional configuration \
53-
As this library adheres to [ECS](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html), the Logs UI knows which fields to show
54-
* Using a common schema across different services and teams makes it possible create reusable dashboards and avoids [mapping explosions](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html#mapping-limit-settings).
55-
56-
### APM Log correlation
57-
58-
If you are using the [Elastic APM Java agent](https://www.elastic.co/guide/en/apm/agent/java/current/index.html),
59-
you can leverage the [log correlation feature](https://www.elastic.co/guide/en/apm/agent/java/current/config-logging.html#config-enable-log-correlation) without any additional configuration.
60-
61-
This lets you jump from the [Span timeline in the APM UI](https://www.elastic.co/guide/en/kibana/master/spans.html) to the
62-
[Logs UI](https://www.elastic.co/guide/en/kibana/7.3/xpack-logs.html),
63-
showing only the logs which belong to the corresponding request.
64-
Vice versa, you can also jump from a log line in the Logs UI to the Span Timeline of the APM UI.
65-
66-
### Additional advantages when using in combination with Filebeat
67-
68-
We recommend using this library to log into a JSON log file and let Filebeat send the logs to Elasticsearch
69-
* Resilient in case of outages \
70-
[Guaranteed at-least-once delivery](https://www.elastic.co/guide/en/beats/filebeat/current/how-filebeat-works.html#at-least-once-delivery)
71-
without buffering within the application, thus no risk of `OutOfMemoryError`s or lost events.
72-
There's also the option to use either the JSON logs or plain-text logs as a fallback.
73-
* Loose coupling \
74-
The application does not need to know the details of the logging backend (URI, credentials, etc.).
75-
You can also leverage alternative [Filebeat outputs](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-output.html),
76-
like Logstash, Kafka or Redis.
77-
* Index Lifecycle management \
78-
Leverage Filebeat's default [index lifemanagement settings](https://www.elastic.co/guide/en/beats/filebeat/master/ilm.html).
79-
This is much more efficient than using daily indices.
80-
* Efficient Elasticsearch mappings \
81-
Leverage Filebeat's default ECS-compatible [index template](https://www.elastic.co/guide/en/beats/filebeat/master/configuration-template.html)
82-
83-
## Mapping
84-
85-
|ECS field | Log4j2 API |
86-
|----------|-------------|
87-
|[`@timestamp`](https://www.elastic.co/guide/en/ecs/current/ecs-base.html) | [`LogEvent#getTimeMillis()`](https://logging.apache.org/log4j/log4j-2.3/log4j-core/apidocs/org/apache/logging/log4j/core/LogEvent.html#getTimeMillis()) |
88-
|[`log.level`](https://www.elastic.co/guide/en/ecs/current/ecs-log.html) | [`LogEvent#getLevel()`](https://logging.apache.org/log4j/log4j-2.3/log4j-core/apidocs/org/apache/logging/log4j/core/LogEvent.html#getLevel()) |
89-
|[`log.logger`](https://www.elastic.co/guide/en/ecs/current/ecs-log.html)|[`LogEvent#getLoggerName()`](https://logging.apache.org/log4j/log4j-2.3/log4j-core/apidocs/org/apache/logging/log4j/core/LogEvent.html#getLoggerName())|
90-
|[`log.origin.file.name`](https://www.elastic.co/guide/en/ecs/current/ecs-log.html)|[`StackTraceElement#getFileName()`](https://docs.oracle.com/javase/6/docs/api/java/lang/StackTraceElement.html#getFileName())|
91-
|[`log.origin.file.line`](https://www.elastic.co/guide/en/ecs/current/ecs-log.html)|[`StackTraceElement#getLineNumber()`](https://docs.oracle.com/javase/6/docs/api/java/lang/StackTraceElement.html#getLineNumber())|
92-
|[`log.origin.function`](https://www.elastic.co/guide/en/ecs/current/ecs-log.html)|[`StackTraceElement#getMethodName()`](https://docs.oracle.com/javase/6/docs/api/java/lang/StackTraceElement.html#getMethodName())|
93-
|[`message`](https://www.elastic.co/guide/en/ecs/current/ecs-base.html)|[`LogEvent#getMessage()`](https://logging.apache.org/log4j/log4j-2.3/log4j-core/apidocs/org/apache/logging/log4j/core/LogEvent.html#getMessage())|
94-
|[`error.type`](https://www.elastic.co/guide/en/ecs/current/ecs-error.html)|[`Throwable#getClass()`](https://docs.oracle.com/javase/7/docs/api/java/lang/Object.html#getClass())|
95-
|[`error.message`](https://www.elastic.co/guide/en/ecs/current/ecs-error.html)|[`Throwable#getMessage()`](https://docs.oracle.com/javase/7/docs/api/java/lang/Throwable.html#getMessage())|
96-
|[`error.stack_trace`](https://www.elastic.co/guide/en/ecs/current/ecs-error.html)|[`Throwable#getStackTrace()`](https://docs.oracle.com/javase/7/docs/api/java/lang/Throwable.html#getStackTrace())|
97-
|[`process.thread.name`](https://www.elastic.co/guide/en/ecs/current/ecs-process.html)|[`LogEvent#getThreadName()`](https://logging.apache.org/log4j/log4j-2.3/log4j-core/apidocs/org/apache/logging/log4j/core/LogEvent.html#getThreadName()) |
98-
|Each MDC entry is a top-level field <a href="#note1" id="note1ref"><sup>1</sup></a>|[`LogEvent#getContextMap()`](https://logging.apache.org/log4j/log4j-2.3/log4j-core/apidocs/org/apache/logging/log4j/core/LogEvent.html#getContextMap())|
99-
|[`tags`](https://www.elastic.co/guide/en/ecs/current/ecs-base.html)|[`LogEvent#getContextStack()`](https://logging.apache.org/log4j/log4j-2.3/log4j-core/apidocs/org/apache/logging/log4j/core/LogEvent.html#getContextStack())|
100-
101-
<a id="note1" href="#note1ref"><sup>1</sup></a> It's recommended to use existing [ECS fields](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for MDC values.
102-
103-
If there is no appropriate ECS field,
104-
consider prefixing your fields with `labels.`, as in `labels.foo`, for simple key/value pairs.
105-
For nested structures consider prefixing with `custom.` to make sure you won't get conflicts if ECS later adds the same fields but with a different mapping.
106-
107-
108-
## Getting Started
109-
110-
### Step 1: Configure application logging
111-
112-
- [Logback](logback-ecs-encoder/README.md) (default for Spring Boot)
113-
- [Log4j2](log4j2-ecs-layout/README.md)
114-
- [Log4j](log4j-ecs-layout/README.md)
115-
- [java.util.logging](jul-ecs-formatter/README.md)
116-
- [JBoss Log Manager](jboss-logmanager-ecs-formatter/README.md)
117-
118-
### Step 2: Enable APM log correlation (optional)
119-
If you are using the Elastic APM Java agent,
120-
set [`enable_log_correlation`](https://www.elastic.co/guide/en/apm/agent/java/current/config-logging.html#config-enable-log-correlation) to `true`.
121-
122-
### Step 3: Filebeat configuration
123-
124-
#### With `filebeat.yml` configuration file
125-
126-
```yaml
127-
filebeat.inputs:
128-
- type: log
129-
paths: /path/to/logs.json
130-
json.keys_under_root: true
131-
json.overwrite_keys: true
132-
133-
# no further processing required, logs can directly be sent to Elasticsearch
134-
output.elasticsearch:
135-
hosts: ["https://localhost:9200"]
136-
137-
# Or to Elastic cloud
138-
# Example:
139-
#cloud.id: "staging:dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRjZWM2ZjI2MWE3NGJmMjRjZTMzYmI4ODExYjg0Mjk0ZiRjNmMyY2E2ZDA0MjI0OWFmMGNjN2Q3YTllOTYyNTc0Mw=="
140-
#cloud.auth: "elastic:YOUR_PASSWORD"
141-
142-
```
143-
144-
For more information, check the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/master/configuring-howto-filebeat.html)
145-
146-
#### With Beats Central Management
147-
148-
- Enroll the beat \
149-
In Kibana, go to `Management` > `Beats` > `Central Management` > `Enroll Beats` and follow the instructions.
150-
- Add a `Filebeat input` configuration block
151-
- Configure the path of the log file(s)
152-
- Set `Other config`
153-
```yaml
154-
type: log
155-
json.keys_under_root: true
156-
json.overwrite_keys: true
157-
```
158-
- Add an `Output` configuration block
159-
- Set `Output type` to `Elasticsearch`
160-
- Configure the `hosts`
161-
- For secured Elasticsearch deployments (like Elastic cloud) set `Username` and `Password`
162-
163-
#### When `stackTraceAsArray` is enabled
164-
165-
Filebeat can normally only decode JSON if there is one JSON object per line.
166-
When `stackTraceAsArray` is enabled, there will be a new line for each stack trace element which improves readability.
167-
But when combining the multiline settings with a `decode_json_fields` we can also handle multi-line JSON.
168-
169-
```yaml
170-
filebeat.inputs:
171-
- type: log
172-
paths: /path/to/logs.json
173-
multiline.pattern: '^{'
174-
multiline.negate: true
175-
multiline.match: after
176-
processors:
177-
- decode_json_fields:
178-
fields: message
179-
target: ""
180-
overwrite_keys: true
181-
# flattens the array to a single string
182-
- script:
183-
when:
184-
has_fields: ['error.stack_trace']
185-
lang: javascript
186-
id: my_filter
187-
source: >
188-
function process(event) {
189-
event.Put("error.stack_trace", event.Get("error.stack_trace").join("\n"));
190-
}
191-
```
29+
ECS Logging Java is licensed under [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0.html).

docs/index.asciidoc

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
include::{asciidoc-dir}/../../shared/versions/stack/current.asciidoc[]
2+
include::{asciidoc-dir}/../../shared/attributes.asciidoc[]
3+
4+
ifdef::env-github[]
5+
NOTE: For the best reading experience,
6+
please view this documentation at https://www.elastic.co/guide/en/ecs-logging/java/current/index.html[elastic.co]
7+
endif::[]
8+
9+
= ECS Logging Java Reference
10+
11+
ifndef::env-github[]
12+
include::./intro.asciidoc[Introduction]
13+
include::./setup.asciidoc[Set up]
14+
include::./structured-logging-log4j2.asciidoc[Structured logging with log4j2]
15+
endif::[]

0 commit comments

Comments
 (0)