Using log4j2 gelflayout, is there a way to suppress adding the underscore in the final payload

Question

We are trying to set a custom field but the GelfLayout with log4j seems to inject an under score when using the Key Value configuration. Is there a way to override that.

Here is the configuration:

 <Console name="GreyLogSysOut" target="SYSTEM_OUT">                
        <GelfLayout compressionType="OFF" includeStackTrace="true" includeThreadContext="true" >  
            <KeyValuePair key="host" value="$${ctx:mdchost}" />            
            <KeyValuePair key="level" value="3" />
            <KeyValuePair key="GL_timestamp" value="${date:yyyy-MM-dd'T'HH:mm:ss.SSSZ}" />
            <KeyValuePair key="GL_timestamp" value="${date:yyyy-MM-dd'T'HH:mm:ss.SSSZ}" />                                        
            <KeyValuePair key="GL_environment" value="$${ctx:mdcenv}" />
            <KeyValuePair key="GL_userid" value="$${ctx:mdcLogAgentId}" />
            <KeyValuePair key="GL_process" value="PriPolApps" />
            <KeyValuePair key="GL_appclass" value="PriPolApps" />
            <KeyValuePair key="GL_appid" value="$${ctx:mdcappid}" />
            <KeyValuePair key="GL_sessionId" value="$${ctx:mdcLogSessionId}" />
            <KeyValuePair key="GL_correlationId" value="$${ctx:correlationId}" />                
            <KeyValuePair key="GL_logdir" value="${sys:appserver.Name}" />
            <KeyValuePair key="GL_jvm" value="$${ctx:jvm}" />
        </GelfLayout>        
    </Console>

But the output injects underscore, is there a way to remove.

"_GL_correlationId":"${ctx:correlationId}", "_GL_logdir":"/usr/local/pfs/logs/server6/", "_GL_jvm":"${ctx:jvm}",

score 0 · Accepted Answer · answered Feb 01 '22 at 15:05

0

Yes, there is a way to remove this. The answer is quite straightforward.

Just use the Custom GelfLayout. You can use the configuration from above but remove the includeStackTrace, includeThreadContext and customFields line:

 <GelfLayout compressionType="OFF" includeStackTrace="true" includeThreadContext="true" >  
            <KeyValuePair key="host" value="$${ctx:mdchost}" />            
            <KeyValuePair key="level" value="3" />
            <KeyValuePair key="GL_timestamp" value="${date:yyyy-MM-dd'T'HH:mm:ss.SSSZ}" />                                            
            <KeyValuePair key="GL_environment" value="$${ctx:mdcenv}" />
            <KeyValuePair key="GL_userid" value="$${ctx:mdcLogAgentId}" />            
        </GelfLayout>

And you will have this output:

"_GL_correlationId":"${ctx:correlationId}", "_GL_logdir":"/usr/local/pfs/logs/server6/", "_GL_jvm":"${ctx:jvm}",

answered Feb 01 '22 at 15:05

PJMan0300

86
5

I am not following, I dont want the underscore to appear – Berlin Brown Feb 01 '22 at 15:19
That's not actually true. There is a line in my answer that you are missing. It's a bit more complicated than that: `` This part is just to override the name of the environment (you have `mdcenv` defined but it is not included in the default layout). This string is included in any case by graylog. Then you have this gelfLayout code with an includeStackTrace and `includeThreadContext` disabled: – PJMan0300 Feb 01 '22 at 15:23
` ` If you want I can update my original post with formatted code. – PJMan0300 Feb 01 '22 at 15:23

Using log4j2 gelflayout, is there a way to suppress adding the underscore in the final payload

1 Answers1