Adding date in keycloak logs

We’re using Keycloak in Kubernetes using the jboss/keycloak Docker image.

We want to import the logs into Elasticsearch, but the default logging format is not useful because the date is missing (only the time is included).
14:47:00,554 INFO

How can I change the logging format to include the date?

Preferably without having to build a custom Docker image, so by passing command line parameters and/or mounting files into the container?

(It would be nice to get rid of the colour codes from the log messages as well, but that’s not a big deal because I can strip them off later.)

You should to switch to json log format (thx for @dasniko ) first, when you want to import logs into Elasticsearch. Your logging life will be far more easier. And this format is comming also with full timestamp, e.g.:

{"timestamp":"2021-12-09T07:47:05.066Z","sequence":150,"loggerClassName":"org.jboss.as.server.logging.ServerLogger_$logger","loggerName":"org.jboss.as","level":"INFO","message":"WFLYSRV0051: Admin console listening on http://0.0.0.0:9990","threadName":"Controller Boot Thread","threadId":25,"mdc":{},"ndc":"","hostName":"0ab9eb948acc","processName":"jboss-modules.jar","processId":1118}

Some parsing rules for logs with type= (e.g. splitting into key=>value) with proper elasticsearch indexing template and you will have decent Keycloak log processing in place.

3 Likes

Thaks a lot,thats helps me, but now I have a question about configuring JSON log format for human readable format.

I used this CLI :


# ##############################################################################
# CONSOLE handler
# ##############################################################################
embed-server --server-config=standalone-ha.xml --std-out=echo

# add yyyy-MM-dd GMT+1 to each CONSOLE log
try
    echo "Changing CONSOLE pattern..."
    /subsystem=logging/pattern-formatter=COLOR-PATTERN:write-attribute(name="pattern", value="%K{level}%z{GMT+1}%d{yyyy-MM-dd HH:mm:ss,SSS XXX} %-5p [%c] (%t) %s%e%n")
catch
end-try

echo "--------------------------------------------------------------------------"

stop-embedded-server