Logging in JSON format

Hiya. I have a weird edge case problem I was hoping someone could help me with? I have a number of legacy apps on Lucee that use cflog tags for various reasons. I’m currently piping all logs (application and Lucee’s own logs) to Graylog by watching folders on disk and collecting the output, but the logs are annoying to parse in Graylog and we’re missing information. Ideal case, all the logs across the whole system would be in json format, written to disk in a known location, so that I can easily parse them in Graylog.

It looks like I can install something like log4j and add a log4j.properties file, but it’s not going to affect the cflog outputs. I can see people redirecting standard output to a udp stream, but for various reasons I can’t send logs over udp to graylog, they have to be on disk. It looks like in the lucee-web.xml.cfm there’s some extra options that might help me here, but I don’t understand how they work. I could also install something like Logbox, but I’d need to change all the current logging tags to make it work.

Any ideas?

Thanks @yamikuronue! @isapir or @micstriit can one (or both) of you chime in on this one? I’m not sure there’s any other people who understand enough about how Lucee logs under the covers to answer this.

I hope that you’re using Lucee 5, which already uses log4j as the underlying logging framework.

Please see the comments in the default lucee-web.xml circa line 180.

You can use XML (yuck!@#) which will be easier to setup and give you the information that you need at the expense of the weight of the XML format.

You can also specify a custom Pattern, or even a custom Class. I haven’t tried that myself, but see https://stackoverflow.com/questions/29387007/does-log4j-support-json-format for some possible options.

P.S. Since we support XML format out of the box, I think that we should support JSON as well. Feel free to open a ticket for that in JIRA.

the docs need updating for Lucee 5 then :slight_smile:

1 Like


Can you or anybody else give any more detail on the steps needed to create a new appender and hook it up? I figure each sentence from someone who has any idea what they’re talking about will save me 8 hours of floundering.

I was able to implement JSON logs for Lucee’s tomcat by following this ( https://kevinklopfenstein.com/java8/tomcat8/log4j2/2018/04/06/tomcat-json/) but now I’m trying to move on to the proper Lucee logs.

FYI, I’m doing this so that I can set up a filebeat to shoot logs to Elastic Stack, and I figure it will be easier if all the files start out as JSON (no parsing necessary).

Update: I wonder if it’s possible to use the classes that I used for tomcat. Maybe some way to specify org.apache.logging.log4j.core.layout.JsonLayout in lucee-web.xml? I don’t know what that syntax would look like, though.



Did you reach any resolution on this? I’ve been trying to get JSON logs for a few days now using the logstash log4j-1.2 class and not having any luck. What did you do?

I’m late to reply, but no, no resolution for JSON logs. I’m basically treating Lucee logs as CSV when parsing them.

you may find the datadog layout a good starting point?

or the sentry extension

pitty there isn’t a logparser on linux, like on windows… that’s a killer log reader/importer/exporter…

Download Log Parser 2.2 from Official Microsoft Download Center

Thanks, @Zackster. I probably won’t revisit this myself since my solution has been working adequately, but maybe someone else will pick up the ball.

@dawesi, it’s been a while, but I’ve used lnav for Linux.