How to get exception class name via pattern

[der-eismann]

Hello, we are trying to pass the class name of an exception to a log4j2 message via layout patterns. The reason for this is that we want to replicate of the old and long deprecated log4j2-gelf library (see here).
However it seems to be impossible to get it from a pattern - the %throwable pattern has a className, but only for the class where the exception occured. From looking at the entries for YAML layout and others, it seems that thrown -> name contains what we need, but how do we get it via a pattern?

[vy]

@der-eismann, Log4j 2 contains a GELF Layout. But all JSON-based layouts (i.e., JSON Layout and GELF Layout) are deprecated in favor of JSON Template Layout (JTL), which provides unmatched customizability and performance compared to other JSON-based layouts in both Log4j and other logging implementations.

JTL already ships a GELF-compatible layout out of the box. You can use it as follows in your log4j2.xml:

<JsonTemplateLayout eventTemplateUri="classpath:GelfLayout.json"/>

You can extend the GelfLayout.json event template to include the exception class name as follows:

<JsonTemplateLayout eventTemplateUri="classpath:GelfLayout.json">
  <EventTemplateAdditionalField key="exceptionClassName"
                                value='{"$resolver": "exception", "field": "className"}'
                                format="JSON"/>
</JsonTemplateLayout>

[der-eismann]

Thanks for the quick answer! We will definitely look into this, as this seems like the best solution for the future. I assume I can just use this together with the Graylog socket?

I count this as the correct answer, but I also found a quick fix by using ${event:Exception} to get the exception class 🙂

[vy]

Yes, a SocketAppender (or some other appender of your preference) targeting Graylog should do the job. Note that you might need nullEventDelimiterEnabled="true" for JTL.

@der-eismann, could you let us know of the outcome, please? Does it work? How does your configuration look like? etc.

[der-eismann]

Hmm, I'm struggling a bit right now with the combination of Appender and Layout. I have:

<Configuration>
    <Appenders>
        <Console name="STDOUT" target="SYSTEM_OUT">
            <PatternLayout pattern="%d %-5p [%t] %C{2} (%F:%L) - %m%n" />
        </Console>

        <Socket name="Graylog" protocol="tcp" host="graylog.default.svc.cluster.local" port="12201">
            <JsonTemplateLayout eventTemplateUri="classpath:GelfLayout.json" />
        </Socket>
    </Appenders>
    <Loggers>
        <Root level="info">
            <AppenderRef ref="STDOUT" />
            <AppenderRef ref="Graylog" />
        </Root>
    </Loggers>

however when starting the application I get:

ERROR StatusConsoleListener Socket contains an invalid element or attribute "JsonTemplateLayout"
ERROR StatusConsoleListener No layout provided for SocketAppender
ERROR StatusConsoleListener Null object returned for Socket in Appenders.
ERROR StatusConsoleListener appenders Appenders has no parameter that matches element Properties
ERROR StatusConsoleListener Unable to locate appender "Graylog" for logger config "root"

I'm running log4j2 2.21.1. Am I doing something wrong? Or are these two not compatible?

[vy]

1. I guess you don't have org.apache.logging.log4j:log4j-layout-template-json in your classpath. Could you verify this, please?
2. You need to add nullEventDelimiterEnabled="true" to the attributes of <JsonTemplateLayout
3. Could you upgrade to the latest Log4j 2 version (i.e., 2.23.1), please?

[der-eismann]

That was it, I wasn't aware that I need another dependency for it. After adding it to the pom.xml, it's now working perfectly 👌

        <Socket name="Graylog" protocol="tcp" host="graylog.default.svc.cluster.local" port="12201">
            <JsonTemplateLayout eventTemplateUri="classpath:CustomGelfLayout.json"
                nullEventDelimiterEnabled="true" locationInfoEnabled="true">
                <EventTemplateAdditionalField key="facility" value="my-application" />
            </JsonTemplateLayout>
        </Socket>

Thanks for helping!