Deprecation notice

This project has been deprecated as of 2018-01-16 and will not be maintained anymore.

If you're looking for a GELF appender for Log4j 2, we recommend using logstash-gelf by Mark Paluch.

DEPRECATED

GELF Appender for Apache Log4j 2

License Build Status Maven Central

This appender for Apache Log4j 2 logs messages to a GELF server like Graylog or logstash.

It's using the official GELF Java client to connect to a remote server.

You can specify the following parameters for the GELF appender in the log4j2.xml configuration file:

log4j2.xml example

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="OFF" packages="org.graylog2.log4j2">
    <Appenders>
        <GELF name="gelfAppender" server="graylog2.example.com" port="12201" hostName="appserver01.example.com">
            <PatternLayout pattern="%logger{36} - %msg%n"/>
            <Filters>
                <Filter type="MarkerFilter" marker="FLOW" onMatch="DENY" onMismatch="NEUTRAL"/>
                <Filter type="MarkerFilter" marker="EXCEPTION" onMatch="DENY" onMismatch="ACCEPT"/>
            </Filters>
            <!-- Additional fields -->
            <KeyValuePair key="foo" value="bar"/>
            <KeyValuePair key="jvm" value="${java:vm}"/>                
        </GELF>
    </Appenders>
    <Loggers>
        <Root level="info">
            <AppenderRef ref="gelfAppender"/>
        </Root>
    </Loggers>
</Configuration>

Java code example

Logger logger = LogManager.getLogger("test");
ThreadContext.put("userId", "testUser");
logger.info("Hello World");

Using variables in the additional fields

The additional fields (KeyValuePair elements) can contain references to variables.

In order for Log4j 2.x to resolve the variable's value, the variable name must have a certain prefix depending on how the variable is provided.

Internally we're making use of Log4j's StrSubstitutor to resolve the variable's value.

This in turn is utilizing the following Log4j Lookups with the prefixes in the following list:

Prefix Documentation
ctx ContextMapLookup
bundle ResourceBundleLookup
date DateLookup
env EnvironmentLookup
java JavaLookup
jndi JndiLookup
jvmrunargs JmxRuntimeInputArgumentsLookup
map MapLookup
sd StructuredDataLookup
sys SystemPropertiesLookup

Please read up on the different variable handling in the linked Javadocs.

Example configuration with variables

<GELF name="gelfAppender" server="graylog2.example.com" port="12201" hostName="appserver01.example.com">
    <KeyValuePair key="user" value="${env:USER}"/>
    <KeyValuePair key="CLIargument" value="${sys:cliargument}"/>
    <KeyValuePair key="jvm" value="${java:vm}"/>
    <KeyValuePair key="fileEncoding" value="${sys:file.encoding}"/>
</GELF>

Versions

GELF Appender for Apache Log4j 2 Release date
1.0.0 29-Sep-2014
1.0.1 21-Oct-2014
1.0.2 09-Feb-2015
1.0.3 11-Feb-2015
1.1.0 16-Jul-2015
1.2.0 18-Jul-2016
1.2.1 11-Aug-2016
1.3.0 24-Aug-2016
1.3.1 22-Oct-2016

This appender uses GELF Java client 1.4.1.

Installation

Maven coordinates

<dependencies>
    <dependency>
        <groupId>org.graylog2.log4j2</groupId>
        <artifactId>log4j2-gelf</artifactId>
        <version>1.3.1</version>
    </dependency>
</dependencies>

License

GELF Appender for Apache Log4j 2

Copyright (C) 2014 TORCH GmbH; 2015-2018 Graylog, Inc.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.