It is sometimes useful to know for every log message at what point in time of the service life it was logged, for example, errors caused by memory leaks may be logged only after the service was up for days, and request latency warnings may be logged only at the first seconds/minutes after it was deployed. It is also interesting how fast the service opened all its database connections or responded to the first successful health check. A simple solution to this might be to log the time stamp on bootstrap and calculate the offset manually. Or logging the uptime explicitly in every log message. But this simple approach has limitations. Manually calculating offsets is a pain. And if you use ELK/Kibana for logs shipment and search you will not be able to use Kibana alerting to create alerts for log events based on this attribute. Explicitly logging the timestamp will not work for third party libraries and dependencies that may log important information and are not under your control.

log4j2 lookup plugin to the rescue! As its documentation says:

Lookups are perhaps the simplest plugins of all.

however, its documentation is not very helpful and the internet is full of outdated/confusing examples.

In this post we will :

• write a log4j2 lookup plugin in Kotlin
• configure log4j2 to use it in a yaml syntax
• use logzio Field Mapping to parse the custom uptime attribute as long
• filter events with uptime of < 60 seconds in kibana with a lucene query

#logzio #log4j2-loockup-plugin #kotlin #kibana #log4j2