CODEWITHSUNDEEP
log4j2splunk
tm1701
tm1701

Reputation: 7581

Log messages in Splunk are shown as ASCII numbers

Our Spring Boot applications run inside Docker containers. We log using e.g. log4j2.

When I use in my Spring Boot application the Spring log4j2.xml configuration file (see below) then log statements are readable (as plain text) in the Docker logs. When I try to read them in Splunk the message is shown like:

message=['123', '34' '116', ... ]

When I remove the log4j2.xml file, then all logs are readable again both in the Docker logs as in Splunk.

Why is this happening? How can I make the messages readable in Splunk?

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="info">
    <Appenders>
        <Console name="Console-Appender" target="SYSTEM_OUT">
            <PatternLayout>
                <pattern>
                    [%-5level] %d{MM-dd HH:mm:ss.SSS} [%t] [%c{1} - %msg%n
                </pattern>
            </PatternLayout>
        </Console>
    </Appenders>
    <Loggers>
        <Logger name="nl.mycompany.xyz" level="info" additivity="false">
            <AppenderRef ref="Console-Appender" />
        </Logger>
        <Root>
            <AppenderRef ref="Console-Appender" />
        </Root>
    </Loggers>
</Configuration>

Upvotes: 3

Views: 340

Answers (1)

Lokesh
Lokesh

Reputation: 1323

Add the param Encoding to your log4j configuration (log4j2.xml file) as UTF-8.

<param name="Encoding" value="UTF-8" />

I have added the above property to your configuration -

<Appenders>
    <Console name="Console-Appender" target="SYSTEM_OUT">
    <param name="Encoding" value="UTF-8" />
        <PatternLayout>
            <pattern>
                [%-5level] %d{MM-dd HH:mm:ss.SSS} [%t] [%c{1} - %msg%n
            </pattern>
        </PatternLayout>
    </Console>
</Appenders>

You can find full examples here for different configurations - https://docs.oracle.com/cd/E10301_01/doc.1013/e10292/logging.htm

Upvotes: 1

Related Questions