{"id":33179576,"url":"https://github.com/agido-malter/logback-elasticsearch-appender","last_synced_at":"2026-01-14T03:28:46.848Z","repository":{"id":57802302,"uuid":"527547339","full_name":"agido-malter/logback-elasticsearch-appender","owner":"agido-malter","description":"Logback Elasticsearch Appender","archived":false,"fork":false,"pushed_at":"2025-09-26T06:37:50.000Z","size":216,"stargazers_count":25,"open_issues_count":3,"forks_count":16,"subscribers_count":3,"default_branch":"staging","last_synced_at":"2025-10-14T08:37:17.828Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/agido-malter.png","metadata":{"files":{"readme":"README.md","changelog":"Changelog.md","contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-08-22T12:07:18.000Z","updated_at":"2025-09-26T06:20:58.000Z","dependencies_parsed_at":"2024-06-14T12:14:35.204Z","dependency_job_id":null,"html_url":"https://github.com/agido-malter/logback-elasticsearch-appender","commit_stats":null,"previous_names":[],"tags_count":23,"template":false,"template_full_name":null,"purl":"pkg:github/agido-malter/logback-elasticsearch-appender","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/agido-malter%2Flogback-elasticsearch-appender","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/agido-malter%2Flogback-elasticsearch-appender/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/agido-malter%2Flogback-elasticsearch-appender/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/agido-malter%2Flogback-elasticsearch-appender/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/agido-malter","download_url":"https://codeload.github.com/agido-malter/logback-elasticsearch-appender/tar.gz/refs/heads/staging","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/agido-malter%2Flogback-elasticsearch-appender/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28408843,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-14T01:52:23.358Z","status":"online","status_checked_at":"2026-01-14T02:00:06.678Z","response_time":107,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-11-16T03:00:36.838Z","updated_at":"2026-01-14T03:28:46.841Z","avatar_url":"https://github.com/agido-malter.png","language":"Java","funding_links":[],"categories":["日志库"],"sub_categories":[],"readme":"Logback Elasticsearch Appender\n===============================\n\nSend log events directly from Logback to Elasticsearch. Logs are delivered asynchronously (i.e. not on the main thread) so will not block execution of the program. Note that the queue backlog can be bounded and messages *can* be lost if Elasticsearch is down and either the backlog queue is full or the producer program is trying to exit (it will retry up to a configured number of attempts, but will not block shutdown of the program beyond that). For long-lived programs, this should not be a problem, as messages should be delivered eventually.\n\nThis software is dual-licensed under the EPL 1.0 and LGPL 2.1, which is identical to the [Logback License](http://logback.qos.ch/license.html) itself.\n\nInfo\n====\nThis project is a fork of internetitem/logback-elasticsearch-appender, which was last committed in 2017. I decided to fork the project and detach it to continue development. Bugfixes and urgent PR were brought together in this project.\n\n\nUsage\n=====\nInclude slf4j and logback as usual (depending on this library will *not* automatically pull them in).\n\nIn your `pom.xml` (or equivalent), add:\n\n     \u003cdependency\u003e\n        \u003cgroupId\u003ecom.agido\u003c/groupId\u003e\n        \u003cartifactId\u003elogback-elasticsearch-appender\u003c/artifactId\u003e\n        \u003cversion\u003e3.0.11\u003c/version\u003e\n     \u003c/dependency\u003e\n\nIn your `logback.xml`:\n\n        \u003cappender name=\"ELASTIC\" class=\"com.agido.logback.elasticsearch.ElasticsearchAppender\"\u003e\n            \u003curl\u003ehttp://yourserver/_bulk\u003c/url\u003e\n            \u003cindex\u003elogs-%date{yyyy-MM-dd}\u003c/index\u003e\n            \u003ctype\u003etester\u003c/type\u003e\n            \u003cloggerName\u003ees-logger\u003c/loggerName\u003e \u003c!-- optional --\u003e\n            \u003cerrorLoggerName\u003ees-error-logger\u003c/errorLoggerName\u003e \u003c!-- optional --\u003e\n            \u003cconnectTimeout\u003e30000\u003c/connectTimeout\u003e \u003c!-- optional (in ms, default 30000) --\u003e\n            \u003cerrorsToStderr\u003efalse\u003c/errorsToStderr\u003e \u003c!-- optional (default false) --\u003e\n            \u003cincludeCallerData\u003efalse\u003c/includeCallerData\u003e \u003c!-- optional (default false) --\u003e\n            \u003clogsToStderr\u003efalse\u003c/logsToStderr\u003e \u003c!-- optional (default false) --\u003e\n            \u003cmaxQueueSize\u003e104857600\u003c/maxQueueSize\u003e \u003c!-- optional (default 104857600) --\u003e\n            \u003cmaxRetries\u003e3\u003c/maxRetries\u003e \u003c!-- optional (default 3) --\u003e\n            \u003creadTimeout\u003e30000\u003c/readTimeout\u003e \u003c!-- optional (in ms, default 30000) --\u003e\n            \u003csleepTime\u003e250\u003c/sleepTime\u003e \u003c!-- optional (in ms, default 250) --\u003e\n            \u003crawJsonMessage\u003efalse\u003c/rawJsonMessage\u003e \u003c!-- optional (default false) --\u003e\n            \u003cincludeMdc\u003efalse\u003c/includeMdc\u003e \u003c!-- optional (default false) --\u003e\n            \u003cincludeKvp\u003efalse\u003c/includeKvp\u003e \u003c!-- optional (default false) --\u003e\n            \u003cmaxMessageSize\u003e100\u003c/maxMessageSize\u003e \u003c!-- optional (default -1 --\u003e\n            \u003cauthentication class=\"com.agido.logback.elasticsearch.config.BasicAuthentication\" /\u003e \u003c!-- optional --\u003e\n            \u003cobjectSerialization\u003etrue\u003c/objectSerialization\u003e \u003c!-- optional (default false) --\u003e\n            \u003ckeyPrefix\u003edata.\u003c/keyPrefix\u003e \u003c!-- optional (default None) --\u003e\n            \u003coperation\u003eindex\u003c/operation\u003e \u003c!-- optional (supported: index, create, update, delete - default create) --\u003e\n            \u003ctimestampFormat\u003eyyyy-MM-dd'T'HH:mm:ss.SSSZ\u003c/timestampFormat\u003e  \u003c!-- optional (default None  if set long to the timestamp milliseconds long value) --\u003e\n            \u003cproperties\u003e\n                \u003c!-- please note that \u003cproperty\u003e tags are also supported, esProperty was added for logback-1.3 compatibility --\u003e\n                \u003cesProperty\u003e\n                    \u003cname\u003ehost\u003c/name\u003e\n                    \u003cvalue\u003e${HOSTNAME}\u003c/value\u003e\n                    \u003callowEmpty\u003efalse\u003c/allowEmpty\u003e\n                \u003c/esProperty\u003e\n                \u003cesProperty\u003e\n                    \u003cname\u003eseverity\u003c/name\u003e\n                    \u003cvalue\u003e%level\u003c/value\u003e\n                \u003c/esProperty\u003e\n                \u003cesProperty\u003e\n                    \u003cname\u003ethread\u003c/name\u003e\n                    \u003cvalue\u003e%thread\u003c/value\u003e\n                \u003c/esProperty\u003e\n                \u003cesProperty\u003e\n                    \u003cname\u003estacktrace\u003c/name\u003e\n                    \u003cvalue\u003e%ex\u003c/value\u003e\n                \u003c/esProperty\u003e\n                \u003cesProperty\u003e\n                    \u003cname\u003elogger\u003c/name\u003e\n                    \u003cvalue\u003e%logger\u003c/value\u003e\n                \u003c/esProperty\u003e\n            \u003c/properties\u003e\n            \u003cheaders\u003e\n                \u003cheader\u003e\n                    \u003cname\u003eContent-Type\u003c/name\u003e\n                    \u003cvalue\u003eapplication/json\u003c/value\u003e\n                \u003c/header\u003e\n            \u003c/headers\u003e\n        \u003c/appender\u003e\n\n        \u003croot level=\"info\"\u003e\n            \u003cappender-ref ref=\"FILELOGGER\" /\u003e\n            \u003cappender-ref ref=\"ELASTIC\" /\u003e\n        \u003c/root\u003e\n\n        \u003clogger name=\"es-error-logger\" level=\"INFO\" additivity=\"false\"\u003e\n            \u003cappender-ref ref=\"FILELOGGER\" /\u003e\n        \u003c/logger\u003e\n\n        \u003clogger name=\"es-logger\" level=\"INFO\" additivity=\"false\"\u003e\n            \u003cappender name=\"ES_FILE\" class=\"ch.qos.logback.core.rolling.RollingFileAppender\"\u003e\n                \u003c!-- ... --\u003e\n                \u003cencoder\u003e\n                    \u003cpattern\u003e%msg\u003c/pattern\u003e \u003c!-- This pattern is important, otherwise it won't be the raw Elasticsearch format anyomre --\u003e\n                \u003c/encoder\u003e\n            \u003c/appender\u003e\n        \u003c/logger\u003e\n\n\n\nConfiguration Reference\n=======================\n\n * `url` (required): The URL to your Elasticsearch bulk API endpoint\n * `index` (required): Name if the index to publish to (populated using PatternLayout just like individual properties - see below)\n * `type` (optional): Elasticsearch `_type` field for records. Although this library does not require `type` to be populated, Elasticsearch may, unless the configured URL includes the type (i.e. `{index}/{type}/_bulk` as opposed to `/_bulk` and `/{index}/_bulk`). See the Elasticsearch [Bulk API](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-bulk.html) documentation for more information\n * `sleepTime` (optional, default 250): Time (in ms) to sleep between attempts at delivering a message\n * `maxRetries` (optional, default 3): Number of times to attempt retrying a message on failure. Note that subsequent log messages reset the retry count to 0. This value is important if your program is about to exit (i.e. it is not producing any more log lines) but is unable to deliver some messages to ES\n * `connectTimeout` (optional, default 30000): Elasticsearch connect timeout (in ms)\n * `readTimeout` (optional, default 30000): Elasticsearch read timeout (in ms)\n * `includeCallerData` (optional, default false): If set to `true`, save the caller data (identical to the [AsyncAppender's includeCallerData](http://logback.qos.ch/manual/appenders.html#asyncIncludeCallerData))\n * `errorsToStderr` (optional, default false): If set to `true`, any errors in communicating with Elasticsearch will also be dumped to stderr (normally they are only reported to the internal Logback Status system, in order to prevent a feedback loop)\n * `logsToStderr` (optional, default false): If set to `true`, dump the raw Elasticsearch messages to stderr\n * `maxQueueSize` (optional, default 104,857,600 = 200MB): Maximum size (in characters) of the send buffer. After this point, *logs will be dropped*. This should only happen if Elasticsearch is down, but this is a self-protection mechanism to ensure that the logging system doesn't cause the main process to run out of memory. Note that this maximum is approximate; once the maximum is hit, no new logs will be accepted until it shrinks, but any logs already accepted to be processed will still be added to the buffer\n * `loggerName` (optional): If set, raw ES-formatted log data will be sent to this logger\n * `errorLoggerName` (optional): If set, any internal errors or problems will be logged to this logger\n * `rawJsonMessage` (optional, default false): If set to `true`, the log message is interpreted as pre-formatted raw JSON message.\n * `includeMdc` (optional, default false): If set to `true`, then all [MDC](http://www.slf4j.org/api/org/slf4j/MDC.html) values will be mapped to properties on the JSON payload.\n * `includeKvp` (optional, default false): If set to `true`, then all key-value-pairs set via [LoggingEventBuilder](https://slf4j.org/api/org/slf4j/spi/LoggingEventBuilder.html) using the [Fluent API](https://slf4j.org/manual.html#fluent) will be mapped to properties on the JSON payload.\n * `maxMessageSize` (optional, default -1): If set to a number greater than 0, truncate messages larger than this length, then append \"`..`\" to denote that the message was truncated\n * `authentication` (optional): Add the ability to send authentication headers (see below)\n * `objectSerialization` (optional): specifies whether to use POJO to JSON serialization \n * `keyPrefix` (optional): objects logged within a message will also be logged separately with this prefix added\n * `operation` (optional, default create): Possible values are: `index`, `create`, `update` \u0026 `delete`, see the Elasticsearch [Bulk API](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-bulk.html) documentation for more information\n\nThe fields `@timestamp` and `message` are always sent and can not currently be configured. Additional fields can be sent by adding `\u003cesProperty\u003e` elements to the `\u003cproperties\u003e` set.\n\n * `name` (required): Key to be used in the log event\n * `value` (required): Text string to be sent. Internally, the value is populated using a Logback PatternLayout, so all [Conversion Words](http://logback.qos.ch/manual/layouts.html#conversionWord) can be used (in addition to the standard static variable interpolations like `${HOSTNAME}`).\n * `allowEmpty` (optional, default `false`): Normally, if the `value` results in a `null` or empty string, the field will not be sent. If `allowEmpty` is set to `true` then the field will be sent regardless\n * `type` (optional, default `String`): type of the field on the resulting JSON message. Possible values are: `String`, `int`, `float` and `boolean`.\n\nGroovy Configuration\n====================\n\nIf you configure logback using `logback.groovy`, this can be configured as follows:\n\n      import com.agido.logback.elasticsearch.ElasticsearchAppender\n\n      appender(\"ELASTIC\", ElasticsearchAppender){\n      \turl = 'http://yourserver/_bulk'\n      \tindex = 'logs-%date{yyyy-MM-dd}'\n      \ttype = 'log'\n      \trawJsonMessage = true\n      \terrorsToStderr = true\n      \tauthentication = new BasicAuthentication()\n      \tdef configHeaders = new HttpRequestHeaders()\n      \tconfigHeaders.addHeader(new HttpRequestHeader(name: 'Content-Type', value: 'text/plain'))\n      \theaders = configHeaders\n      }\n\n      root(INFO, [\"ELASTIC\"])\n\nAuthentication\n==============\n\nAuthentication is a pluggable mechanism. You must specify the authentication class on the XML element itself. The currently supported classes are:\n\n* `com.agido.logback.elasticsearch.config.BasicAuthentication` - Supports two configuration methods:\n  * **Recommended**: Use `\u003cusername\u003e` and `\u003cpassword\u003e` elements (no URL-encoding required):\n    ```xml\n    \u003cauthentication class=\"com.agido.logback.elasticsearch.config.BasicAuthentication\"\u003e\n        \u003cusername\u003emyuser\u003c/username\u003e\n        \u003cpassword\u003ep@ss€word#123\u003c/password\u003e\n    \u003c/authentication\u003e\n    ```\n  * **Legacy**: Credentials in URL (special characters must be URL-encoded, e.g., `@` → `%40`):\n    ```xml\n    \u003curl\u003ehttp://user:p%40ssword@yourserver/_bulk\u003c/url\u003e\n    ```\n* `com.agido.logback.elasticsearch.config.AWSAuthentication` - Authenticate using the AWS SDK, for use with the [Amazon Elasticsearch Service](https://aws.amazon.com/elasticsearch-service/) (note that you will also need to include `com.amazonaws:aws-java-sdk-core` as a dependency)\n\nLogback Access\n==============\n\nIncluded is also an Elasticsearch appender for Logback Access. The configuration is almost identical, with the following two differences:\n\n * The Appender class name is `com.agido.logback.elasticsearch.ElasticsearchAccessAppender`\n * The `value` for each `esProperty` uses the [Logback Access conversion words](http://logback.qos.ch/manual/layouts.html#logback-access).\n\nPrevent Major API change\n========================\n\nTo prevent a major and/or breaking API change, the old packagename com.internetitem could also used\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fagido-malter%2Flogback-elasticsearch-appender","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fagido-malter%2Flogback-elasticsearch-appender","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fagido-malter%2Flogback-elasticsearch-appender/lists"}