amosshi commented on issue #3435:
URL:
https://github.com/apache/logging-log4j2/issues/3435#issuecomment-2646111525
HI @ppkarwasz,
The term "_structured layout_" here, means to "**key=value**" format.
When the log message is in **key=value** format, Both Splunk and ELK can
recognize the **keys** automatically as a searchable filed. So we can do
**filter**, **reporting**, **dashboard** based on the key.
Sample: we may have a Pattern Layout log looks like bellow, and the row
bellow can be considered as "**Structured**" somehow, because Splunk/ELK can
extract the keys automatically
> timestamp=202501082308311 level=W logger=com.mycomany.MyApp
company=abcenterprise message="the user cannot be found"
targetUserHash=e0d123e5f316bef7 {dbschema=abcschema, traceid=1234567,
contextid=qwertyu, sessionid=asdfghj}
Where
- `{dbschema=abcschema, traceid=1234567, contextid=qwertyu,
sessionid=asdfghj}` is from the
[MdcPatternConverter](https://github.com/apache/logging-log4j2/blob/2.24.x/log4j-core/src/main/java/org/apache/logging/log4j/core/pattern/MdcPatternConverter.java)
It will be more perfect if **MdcPatternConverter** can generate a format
like bellow, where the `{`, `,`, `}` characters are removed:
- `dbschema=abcschema traceid=1234567 contextid=qwertyu sessionid=asdfghj`
Benefits
- It will make Splunk/ELK parse easier
- It will generate (a little) smaller log - so will save disk/network/cpu,
use less energy and make the world greener
- Smaller log size will also save Splunk license cost - could make
application developers get more bonus
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscr...@logging.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
