Mulesoft Splunk Integration configuring Log4j
Synopsis
Requirement: I want to disable CloudHub logs and integrate CloudHub application with external logging system (ex: Splunk). All MuleSoft application’s logs should flow to both the log system and CloudHub.
Solution: Yes, We can achieve this integrating mule application with external logging system (example: Splunk) by configuring Log4j.xml. Hence, you can enable custom logos of your applications.
Perquisites
1. Configuring Log4j.xml
2. Adding Maven dependency in application pom.xml
3. Disabling CloudHub logs in Cloudhub.
Create Your Log4j Configuration
Let’s understand the Log4j configuration a little bit.
Under Package Explorer, mule project > src/main/resources you will get the Log4j.xml for a specific project.
Log4j.xml file has the bellow tags:
- <Configuration> — root tag
- <Appenders> — Sub tag under root tag
- <Console> — tag under Appenders tag.
- <Loggers> — Sub tag under root tag
- <AsyncRoot> -sub tag underloggers tag
Different type Appenders:
SplunkHttp: Appender sends log data to the Splunk system
Log4J2CloudhubLogAppender :Appender sends log data to CloudHub
RollingFile: Appender sends log data to the filesystem of the VM
Example :
<!-- SplunkHttp Appender --><SplunkHttp name="splunk"url="https://prd-p-46ls0.splunkcloud.com:8088/"token="014eba15-ad79-4bad-904a-9fe65580fca9" index="main" disableCertificateValidation="true"><PatternLayout pattern="%-5p %d [%t] [event: %X{correlationId}] %c: %m%n" /></SplunkHttp><!-- RollingFile Appender --><RollingFile name="file" fileName="${sys:mule.home}${sys:file.separator}logs${sys:file.separator}mule-custom-logging-api.log"filePattern="${sys:mule.home}${sys:file.separator}logs${sys:file.separator}mule-custom-logging-api-%i.log"><PatternLayout pattern="%-5p %d [%t] [processor: %X{processorPath}; event: %X{correlationId}] %c: %m%n" /><SizeBasedTriggeringPolicy size="10 MB" /><DefaultRolloverStrategy max="10"/></RollingFile><!-- RollingFile Appender --><Log4J2CloudhubLogAppender name="CLOUDHUB"addressProvider="com.mulesoft.ch.logging.DefaultAggregatorAddressProvider"applicationContext="com.mulesoft.ch.logging.DefaultApplicationContext"appendRetryIntervalMs="${sys:logging.appendRetryInterval}"appendMaxAttempts="${sys:logging.appendMaxAttempts}"batchSendIntervalMs="${sys:logging.batchSendInterval}"batchMaxRecords="${sys:logging.batchMaxRecords}" memBufferMaxSize="${sys:logging.memBufferMaxSize}"journalMaxWriteBatchSize="${sys:logging.journalMaxBatchSize}"journalMaxFileSize="${sys:logging.journalMaxFileSize}"clientMaxPacketSize="${sys:logging.clientMaxPacketSize}"clientConnectTimeoutMs="${sys:logging.clientConnectTimeout}"clientSocketTimeoutMs="${sys:logging.clientSocketTimeout}"serverAddressPollIntervalMs="${sys:logging.serverAddressPollInterval}"serverHeartbeatSendIntervalMs="${sys:logging.serverHeartbeatSendIntervalMs}"statisticsPrintIntervalMs="${sys:logging.statisticsPrintIntervalMs}"><PatternLayout pattern="[%d{MM-dd HH:mm:ss}] %-5p %c{1} [%t]: %m%n" />
</Log4J2CloudhubLogAppender>
PatternLayout:
PatternLayout extends a flexible layout configurable with the pattern string. The goal of this class is to format a LogEvent and return the results. Based on required the log format you can select the Pattern Layout for different Appender.
Example
<PatternLayout pattern="%-5p %d [%t] [event: %X{correlationId}] %c: %m%n" /><PatternLayout pattern="%m%" />
Loggers
<AsyncRoot> Sends the different level logs to different systems predefined in Appender. Make sure you define the correct AppenderRefference or name that you predefined in Appender section to flow the logs to different Systems.
Example:
<AsyncRoot level="INFO">
<AppenderRef ref="splunk" />
<AppenderRef ref="CLOUDHUB" />
<AppenderRef ref="Console"/>
<AppenderRef ref="file" />
</AsyncRoot>Configuration Process
Step 1: Will add the below packages in configuration tag for enabling spunk logging.
<Configuration status="INFO" name="cloudhub"packages="com.mulesoft.ch.logging.appender,com.splunk.logging,org.apache.logging.log4j">
Step 2: Adding SplunkHttp appender in Log4j with Splunk host and authorization token details.
<SplunkHttp name="splunk"
url="https://prd-p-46ls0.splunkcloud.com:8088/"token="014eba15-ad79-4bad-904a-9fe65580fca9" index="main" disableCertificateValidation="true">
<PatternLayout pattern="%-5p %d [%t] [event: %X{correlationId}] %c: %m%n" /></SplunkHttp>Log4j Configuration
Below is full Log4j2.xml which can be used for your application for enabling custom logging on CloudHub and Splunk.
<?xml version="1.0" encoding="utf-8"?><Configuration status="INFO" name="cloudhub"packages="com.mulesoft.ch.logging.appender, com.splunk.logging,org.apache.logging.log4j"><Appenders><Console name="Console" target="SYSTEM_OUT"><PatternLayout pattern="%-5p %d [%t] [event: %X{correlationId}] %c: %m%n" /></Console>
<Console name="ConsoleLogUtil" target="SYSTEM_OUT"><PatternLayout pattern="%m%n" /></Console><RollingFile name="file" fileName="${sys:mule.home}${sys:file.separator}logs${sys:file.separator}mule-custom-logging-api.log"
filePattern="${sys:mule.home}${sys:file.separator}logs${sys:file.separator}mule-custom-logging-api-%i.log">
<PatternLayout pattern="%-5p %d [%t] [processor: %X{processorPath}; event: %X{correlationId}] %c: %m%n" />
<SizeBasedTriggeringPolicy size="10 MB" />
<DefaultRolloverStrategy max="10"/>
</RollingFile>
<SplunkHttp name="splunk" url="https://prd-p-46ls0.splunkcloud.com:8088/" token="014eba15-ad79-4bad-904a-9fe65580fca9" index="main" disableCertificateValidation="true"><PatternLayout pattern="%-5p %d [%t] [event: %X{correlationId}] %c: %m%n" />
</SplunkHttp><Log4J2CloudhubLogAppender name="CLOUDHUB" addressProvider="com.mulesoft.ch.logging.DefaultAggregatorAddressProvider"applicationContext="com.mulesoft.ch.logging.DefaultApplicationContext"appendRetryIntervalMs="${sys:logging.appendRetryInterval}"appendMaxAttempts="${sys:logging.appendMaxAttempts}"batchSendIntervalMs="${sys:logging.batchSendInterval}"batchMaxRecords="${sys:logging.batchMaxRecords}" memBufferMaxSize="${sys:logging.memBufferMaxSize}"journalMaxWriteBatchSize="${sys:logging.journalMaxBatchSize}"journalMaxFileSize="${sys:logging.journalMaxFileSize}"clientMaxPacketSize="${sys:logging.clientMaxPacketSize}"clientConnectTimeoutMs="${sys:logging.clientConnectTimeout}"clientSocketTimeoutMs="${sys:logging.clientSocketTimeout}"serverAddressPollIntervalMs="${sys:logging.serverAddressPollInterval}"serverHeartbeatSendIntervalMs="${sys:logging.serverHeartbeatSendIntervalMs}"statisticsPrintIntervalMs="${sys:logging.statisticsPrintIntervalMs}"><PatternLayout pattern="[%d{MM-dd HH:mm:ss}] %-5p %c{1} [%t]: %m%n" />
</Log4J2CloudhubLogAppender>
</Appenders>
<Loggers><AsyncLogger name="org.mule.service.http" level="WARN"/><AsyncLogger name="org.mule.extension.http" level="WARN"/><!-- Mule logger -->
<AsyncLogger name="org.mule.runtime.core.internal.processor.LoggerMessageProcessor" level="INFO"/><AsyncRoot level="INFO">
<AppenderRef ref="splunk" />
<AppenderRef ref="CLOUDHUB" />
<AppenderRef ref="Console"/>
<AppenderRef ref="file" />
</AsyncRoot></Loggers></Configuration>
Mule Application & Maven Configuration
For SplunkHttp appender, we need to add the following dependency and repository in pom.xml of the mule application. Also, make sure, all the loggers must be asynchronous types.
Dependency:
<dependency><groupId>com.splunk.logging</groupId><artifactId>splunk-library-javalogging</artifactId><version>1.7.3</version></dependency><dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.10.0</version></dependency><dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-api</artifactId><version>2.10.0</version></dependency>
Repository:
<repositories><repository><id>splunk-artifactory</id><name>Splunk Releases</name><url>https://repo.spring.io/libs-release/</url><layout>default</layout></repository>
Enable Custom Log4j Configurations in CloudHub
After you configure the Log4j appender, deploy the application to CloudHub and follow these steps to disable CloudHub logs:
In Anypoint Platform while deploying any application in Runtime Manager > Click the Type column to display the details pane for the application > Click Manage Application. In the Settings page, Click Disable CloudHub logs. In the Disabling CloudHub logs confirmation window, select the checkboxes to verify that you want to disable CloudHub logs.
Refer to the below screenshots:
Sample Application
Searching application logs in Splunk Console
Conclusion
After your application starts, logs start flowing to your custom Log4j appender and are viewable on your target logging system. This way you can enable custom logging in your system.
