JSON logging format #10209

jangaraj · 2022-02-14T18:56:17Z

jangaraj
Feb 14, 2022

Wildfly based Keycloak provides option to change logging format to JSON, e.g.:

embed-server --server-config=standalone-ha.xml --std-out=echo
/subsystem=logging/json-formatter=JSON/:add
/subsystem=logging/console-handler=CONSOLE/:write-attribute(name=named-formatter,value=JSON)
stop-embedded-server

Quarkus based Keycloak doesn't have this option (v 17.0.0). generated logs are in the text format only. Logging options:

--log-format <format>
                     The format of log entries. If the format has spaces in it, you need to escape
                       the value such as "<format>". Default: %d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c]
                       (%t) %s%e%n.
--log-level <category:level>
                     The log level of the root category or a comma-separated list of individual
                       categories and their levels. For the root category, you don't need to
                       specify a category. Default: info.

Naive solution with current config option:

log-format={"time":"%d{yyyy-MM-dd HH:mm:ss,SSS}", "category":"%c", "thread-name":"%t", "thread-id":"%t{id}", "process-id":"%i", "message":"%m", "exception":"%e"}%n

doesn't work very well - it may generate empty fields, (e.g. empty exception, when there is no exception).

It will help if Keycloak admin will have easy option switch from the text log format to json format (which can be then parsed easily with standard logging tools). This probably can be easily implemented via quarkus extension quarkus-logging-json.
It will help if also full message (%m)/short message (%s) is generated in the JSON format. Use case: Keycloak event messages don't need additional parsing - default Keycloak JSON logs will be enough to generate/calculate/aggregate all possible metrics/reports, e.g. succesfull/failed logins of (unique) users/clients per selected time period, ...

Example of Keycloak event in the text format:

type=CLIENT_LOGIN, realmId=XYZ, clientId=CLIENTID, userId=USERID, ipAddress=X.X.X.X, token_id=TOKENID, grant_type=client_credentials, scope='email profile', client_auth_method=client-secret, username=USERNAME, authSessionParentId=PARENTID, authSessionTabId=TABID

Which should be logged in the JSON format as:

{
	"type": "CLIENT_LOGIN",
	"realmId": "XYZ",
	"clientId": "CLIENTID",
	"userId": "UERID",
	"ipAddress": "X.X.X.X",
	"token_id": "TOKENID",
	"grant_type": "client_credentials",
	"scope": "'email profile'",
	"client_auth_method": "client-secret",
	"username": "USERNAME",
	"authSessionParentId": "PARENTID",
	"authSessionTabId": "TABID"
}

@dasniko mentioned that in the community:

This is not possible with the default logging event listener, as it is concatenating the message to a string. The actual message is the value to the key message.

If you also want to have the message details printed as JSON output, you‘ll have to implement a custom event listener, doing exactly this.

DGuhr · 2022-02-14T21:00:22Z

DGuhr
Feb 14, 2022

Hey. On point 1 i am totally aligned and will provide a PR shortly. Can you elaborate a bit more on point 2? What option would you set and what would be your expected outcome/log output? Thanks!

2 replies

jangaraj Feb 14, 2022
Author

Description updated.

dasniko Feb 15, 2022

Be careful not to mix up two different things.

One is the general logging format of log messages. That should be easily switchable to a JSON format instead of plain text.

Second is the raw message payload from the default events logger. As the message payload is concatenated as a string in the events listener, this would mean to change it there. And as it is "just" the value of the message key in the actual log entry, it would be stringified JSON object as value in the JSON-ified log message.

DGuhr · 2022-03-08T11:23:39Z

DGuhr
Mar 8, 2022

Initial json console logging support is now in latest main, see #10576 - expect some more options when we get to #10618 - we need quarkus 2.8.0 to be released though.

0 replies

Navigation Menu

Repository navigation

JSON logging format #10209

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

JSON logging format #10209

Uh oh!

Uh oh!

jangaraj Feb 14, 2022

Replies: 2 comments · 2 replies

Uh oh!

Uh oh!

DGuhr Feb 14, 2022

Uh oh!

jangaraj Feb 14, 2022 Author

Uh oh!

dasniko Feb 15, 2022

Uh oh!

DGuhr Mar 8, 2022

jangaraj
Feb 14, 2022

Replies: 2 comments 2 replies

DGuhr
Feb 14, 2022

jangaraj Feb 14, 2022
Author

DGuhr
Mar 8, 2022