Logback appender that sends GELF messages  

Send log events to a Graylog server by GELF protocol over UDP, TCP, TCP over SSL, or AMQP transport.

Usage

Add the following dependency to your project:

<dependency>
  <groupId>com.github.pukkaone</groupId>
  <artifactId>logback-gelf</artifactId>
  <version>1.1.11</version>
</dependency>

Configure a logback appender to send by UDP (XML configuration format):

<appender name="GRAYLOG" class="com.github.pukkaone.gelf.logback.GelfAppender">
  <graylogHost>graylog.example.com</graylogHost>
  <originHost>my.machine.example.com</originHost>
  <levelIncluded>true</levelIncluded>
  <locationIncluded>false</locationIncluded>
  <loggerIncluded>true</loggerIncluded>
  <markerIncluded>false</markerIncluded>
  <mdcIncluded>false</mdcIncluded>
  <threadIncluded>false</threadIncluded>
  <facility>gelf-java</facility>
  <additionalField>application=MyApplication</additionalField>
  <additionalField>environment=development</additionalField>
</appender>

To send by AMQP:

<appender name="GRAYLOG" class="com.github.pukkaone.gelf.logback.GelfAppender">
  <amqpURI>amqp://amqp.example.com</amqpURI>
  <amqpExchange>messages</amqpExchange>
  <amqpRoutingKey>gelfudp</amqpRoutingKey>
  <amqpMaxRetries>5</amqpMaxRetries>
  <amqpAutomaticRecovery>true</amqpAutomaticRecovery>
  <originHost>my.machine.example.com</originHost>
  <facility>gelf-java</facility>
  <additionalField>application=MyApplication</additionalField>
  <additionalField>environment=development</additionalField>
</appender>

Options

graylogHost

Host name of Graylog server where it will send the GELF messages. Prefix with udp: to send by UDP. Prefix with tcp: to send by TCP. Prefix with ssl: to send by TCP over SSL. If no prefix is present, then the transport is UDP.

graylogPort

Port on which the Graylog server is listening; default 12201 (optional)

originHost

Name of the originating host; defaults to the local hostname (optional)

levelIncluded

Include SLF4J level in the GELF message; default true (optional)

locationIncluded

Include caller file name and line number. Generating caller location information will severely impact execution speed; default false (optional)

loggerIncluded

Include SLF4J logger name in the GELF message; default true (optional)

markerIncluded

Include SLF4J marker name in the GELF message; default false (optional)

mdcIncluded

Include SLF4J MDC properties in the GELF message; default false (optional)

facility

Facility value to send in the GELF message; default gelf-java (optional)

additionalField

Include an additional field with literal value in the GELF message. Give the field name and value in the format key=value. (optional)

amqpURI

AMQP URI (required when using AMQP integration)

amqpExchange

AMQP exchange name - should be the same as setup in graylog-radio (required when using AMQP integration)

amqpRoutingKey

AMQP routing key - should be the same as setup in graylog-radio (required when using AMQP integration)

amqpMaxRetries

Maximum retries count; default value 0 (optional)

amqpAutomaticRecovery

Sets automatic recovery flag for underlying AMQP connection factory; default false (optional)

sslTrustAllCertificates

Skip SSL server certificate validation; default false (optional)

Customize GELF messages

If you want to customize the GELF messages sent by the appender, you can replace the class that converts log events to GELF messages with your own implementation. Define a class implementing the GelfMessageFactory interface. Alternatively, you may extend the DefaultGelfMessageFactory class, which implements this interface.

Configure the custom GELF message factory in the appender:

<appender name="GRAYLOG" class="com.github.pukkaone.gelf.logback.GelfAppender">
  ...
  <marshaller class="com.example.MyGelfMessageFactory">
    <mdcTimestampProperty>ReceivedDateTime</mdcTimestampProperty>
  </marshaller>
  ...
</appender>

If you just want to customize the short_message and full_message fields of the GELF messages sent by the appender, you can customize the DefaultGelfMessageFactory to apply different patterns.

Configure the default GELF message factory in the appender:

<appender name="GRAYLOG" class="com.github.pukkaone.gelf.logback.GelfAppender">
  ...
  <marshaller class="com.github.pukkaone.gelf.logback.DefaultGelfMessageFactory">
    <shortMessagePattern>%.-20m</shortMessagePattern> <!-- at most 20 initial characters -->
    <fullMessagePattern>%m%n%xEx</fullMessagePattern> <!-- log message, newline, and stack trace -->
  </marshaller>
  ...
</appender>

The default patterns are:

shortMessagePattern

%m%nopex - log message, excludes stack trace

fullMessagePattern

%xEx - stack trace