Configure keycloak logging (json), to log the message inside the log message as json (map?) #19328

lochy89 · 2023-03-25T09:42:42Z

lochy89
Mar 25, 2023

How can I configure the message content to json format? I want to display keycloak.events in elasticsearch, but the message content is a string and not json. I mean the message inside the log message.
Is it possible?

Example log:

{"timestamp":"2023-03-24T15:32:14.293Z","sequence":8479,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.keycloak.events","level":"WARN","message":"type=LOGIN_ERROR, realmId=master, clientId=security-admin-console, userId=null, ipAddress=172.18.0.6, error=user_not_found, auth_method=openid-connect, auth_type=code, redirect_uri=https://keycloak.example-domain.com/admin/master/console/#/, code_id=5c2c1240-3374-4655-ac21-ce9ecffc7916, username=test, authSessionParentId=5c2c1240-3374-4655-ac21-ce9ecffc7916, authSessionTabId=jm0L-tr5K5A","threadName":"executor-thread-2","threadId":52,"mdc":{},"ndc":"","hostName":"keycloak-0","processName":"QuarkusEntryPoint","processId":1}

I want to extract the values from message like type, username, clientId and so on with fluentbit and use those values in elasticsearch.
But because the message is a string, i can not work with them.

I need something like this:
(generated with fluentbit kubernetes filter plugin)

"kubernetes": {
    "pod_name": "keycloak-0",
    "namespace_name": "keycloak",
    "pod_id": "pod_id_random",
    "host": "hostname",
    "container_name": "keycloak",
    "docker_id": "some_random_id",
    "container_hash": "container_hash",
    "container_image": "container_image"
}

Can you give me some advice?
Thank you in advance!
Regards!

Navigation Menu

Repository navigation

Configure keycloak logging (json), to log the message inside the log message as json (map?) #19328

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Configure keycloak logging (json), to log the message inside the log message as json (map?) #19328

Uh oh!

lochy89 Mar 25, 2023

Replies: 0 comments

lochy89
Mar 25, 2023