You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
JSON logging in ECS format with custom fields that contain nested JSON
#43222
We'd like to add custom fields with nested JSON to the JSON logs in ECS format.
See "custom" field in the exemple below { "@timestamp": "2025-10-03T14:57:55.284872257Z", "event.sequence": 9845, "log.logger": "org.keycloak.events", "level": "WARN", "message": "a message", "custom": { "field1":"value1" }, "process.thread.name": "executor-thread-3", "process.thread.id": 60, "mdc": {}, "ndc": "", "host.hostname": "b01f8816895a", "process.name": "/usr/lib/jvm/java-21-openjdk-21.0.8.0.9-1.el9.x86_64/bin/java", "process.pid": 1, "ecs.version": "1.12.2", "data_stream.type": "logs", "service.name": "Keycloak", "service.version": "26.2.8.redhat-00001", "service.environment": "prod" }
The Quarkus logging JSON extension integrated in Keycloak doesn't support it.
We tried to integrate the Quakiverse Logging JSON extension. but it seems that Keycloak configuration doesn't allow to replace one extension by the other.
My question is whether it can be an option to develop our own Logging extension with the same configuration properties as the Quarkus extension and then use it as a replacement in our application pom.xml (i.e. exclude Quarkus extension from keycloak dependencies and include our custom extension) ?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hi,
We'd like to add custom fields with nested JSON to the JSON logs in ECS format.
See "custom" field in the exemple below
{ "@timestamp": "2025-10-03T14:57:55.284872257Z", "event.sequence": 9845, "log.logger": "org.keycloak.events", "level": "WARN", "message": "a message", "custom": { "field1":"value1" }, "process.thread.name": "executor-thread-3", "process.thread.id": 60, "mdc": {}, "ndc": "", "host.hostname": "b01f8816895a", "process.name": "/usr/lib/jvm/java-21-openjdk-21.0.8.0.9-1.el9.x86_64/bin/java", "process.pid": 1, "ecs.version": "1.12.2", "data_stream.type": "logs", "service.name": "Keycloak", "service.version": "26.2.8.redhat-00001", "service.environment": "prod" }The Quarkus logging JSON extension integrated in Keycloak doesn't support it.
We tried to integrate the Quakiverse Logging JSON extension. but it seems that Keycloak configuration doesn't allow to replace one extension by the other.
My question is whether it can be an option to develop our own Logging extension with the same configuration properties as the Quarkus extension and then use it as a replacement in our application pom.xml (i.e. exclude Quarkus extension from keycloak dependencies and include our custom extension) ?
All reactions