JsonTemplateLayout + PatternLayout on Message Value

[paulwinters]

Hello,

I am working on transitioning our logging from a PatternLayout that uses a class extending LogEventPatternConverter to JsonTemplateLayout so logs are printed in JSON for easier ingestion. I wasn't able to find anything on how to apply a pattern to the message value produced by JsonTemplateLayout. If anyone could point me to an example or an alternative way of doing that, that would be great; thanks.

[vy]

I am working on transitioning our logging from a PatternLayout that uses a class extending LogEventPatternConverter to JsonTemplateLayout so logs are printed in JSON for easier ingestion. I wasn't able to find anything on how to apply a pattern to the message value produced by JsonTemplateLayout.

@paulwinters, I don't understand the question. Could you be a little bit more elaborate, please? Providing an example would also help a lot.

[paulwinters]

Sure.

We are masking our log statements with the following log4j2.xml.

<?xml version="1.0" encoding="UTF-8"?>
<Configuration packages="package.to.masking.class">
    <Appenders>
        <Console name="Console" target="SYSTEM_OUT" follow="true">
            <PatternLayout>
                <Pattern>
                    %d{yyyy-MM-dd HH:mm:ss} %-5p %c{1}:%L %m%ex{full}%n%maskLogs
                </Pattern>
            </PatternLayout>
        </Console>
    </Appenders>
    <Loggers>
        <Root level="info">
            <AppenderRef ref="Console" />
        </Root>
    </Loggers>
</Configuration>

Using a class

@Plugin(name="LogMaskingConverter", category = "Converter")
@ConverterKeys({"maskLogs"})
public class LogMaskingConverter extends LogEventPatternConverter {
...
}

This is working for us.

However, to improve our logging capture, we want to change to a JSON log layout for easier ingestion into our observability product. I saw in the documentation that JsonLayout is deprecated and we should instead use JsonTemplateLayout.

So, I changed the log4j2.xml to:

        <Console name="Console" target="SYSTEM_OUT" follow="true">
            <JsonTemplateLayout eventTemplateUri="classpath:jsonLoggingTemplate.json"/>
        </Console>

I also created jsonLoggingTemplate.json, which has the message resolver.

{
 ...
  "message": {
    "$resolver": "message",
    "stringified": true
  },
  ...
}

This is outputting our log statements as JSON as expected, but I still want to mask the value of the message as we did previously. From the documentation, it wasn't clear how to do that, and I couldn't find any examples online, so I wanted to reach out here.

[vy]

There are a couple of approaches you can take here. But I guess the simplest one would be to create your custom message resolver – see extending JTL docs – similar to what you have done with LogMaskingConverter. There, before masking the output, you can either try to format the LogEvent message yourself, or delegate to the existing MessageResolver class instead. You need to keep in mind that MessageResolver (i.e., the default message resolver) can output either a JSON object or string depending on the type of the LogEvent#getMessage() received. You need to take that into account while masking sensitive data.