Send Quarkus logs to Logstash (ELK) in json format over logstash tcp input

Question

What I'm trying to achieve is to send the logs of my Quarkus application to an ELK stack

I'm aware this is documented here Send logs to Logstash / the Elastic Stack (ELK) but this solution uses the GELF format which is not flexible enough, I would like to send the logs in json format, and be able to add custom fields to it.

I have tried using the quarkus-logging-logback plugin

<dependency>
    <groupId>io.quarkiverse.logging.logback</groupId>
    <artifactId>quarkus-logging-logback</artifactId>
    <version>1.1.2</version>
</dependency>

and configured it through the logback.xml file with the net.logstash.logback.appender.LogstashTcpSocketAppender appender, and the net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder encoder.

This works fine except for the fact that I'm using reading properties from Spring Cloud Config server and it seems that those properties are only available after the logger gets initialised, so the appender destination (which I read from a property in SCC) is not available yet.

So the question is

• is there a way to 'natively' send json logging to a logstash tcp input
• make the logback logger delay its initialisation until all properties are loaded (including the ones coming from SCC)

Answer 1

In case anybody is interested, I ended up implementing the feature in Quarkus core itself. It will be part of the next Quarkus release (3.17.x)

What you'll need is the quarkus-logging-json dependency

    <dependency>
        <groupId>io.quarkus</groupId>
        <artifactId>quarkus-logging-json</artifactId>
    </dependency>

and specify the following properties to enable socket logging. Specify the log-format if you want to format the json in ECS format

    quarkus.log.socket.enable=true
    quarkus.log.socket.endpoint=localhost:4560
    quarkus.log.socket.json=true
    quarkus.log.socket.json.exception-output-type=formatted
    quarkus.log.socket.json.log-format=ECS