如何通过Logstash调整Logback日志JSON字段顺序

当前你用LogstashEncoder输出的JSON日志，level字段默认排在末尾，要把它移到ts（时间戳）后面，可采用以下两种方案，推荐第一种更灵活的实现方式：

方案一：使用PatternJsonEncoder（推荐） #

PatternJsonEncoder支持完全自定义字段顺序，直接按需求顺序定义每个字段即可。修改后的logback.xml配置如下：

<configuration scan="true" scanPeriod="30 seconds">

<appender name="json" class="ch.qos.logback.core.ConsoleAppender">
    <target>System.out</target>
    <encoder class="net.logstash.logback.encoder.PatternJsonEncoder">
        <pattern>
            {
                "ts": "%d{HH:mm:ss.SSS}",
                "level": "%level",
                "msg": "%message",
                "logger": "%logger"
            }
        </pattern>
        <!-- 忽略不需要的自动添加字段 -->
        <excludeMdc>true</excludeMdc>
        <excludeContext>true</excludeContext>
        <excludeStackTrace>true</excludeStackTrace>
    </encoder>
</appender>

<root level="info">
    <appender-ref ref="json"/>
</root>
</configuration>

方案二：基于LogstashEncoder的变通方法 #

如果不想更换编码器，可通过添加自定义level字段并忽略原level字段的方式实现，自定义字段会排在默认字段的前面：

<configuration scan="true" scanPeriod="30 seconds">

<appender name="json" class="ch.qos.logback.core.ConsoleAppender">
    <target>System.out</target>
    <encoder class="net.logstash.logback.encoder.LogstashEncoder">
        <timestampPattern>HH:mm:ss.SSS</timestampPattern>
        <fieldNames>
            <timestamp>ts</timestamp>
            <level>[ignore]</level> <!-- 忽略原level字段 -->
            <message>msg</message>
            <thread>[ignore]</thread>
            <levelValue>[ignore]</levelValue>
            <logger>logger</logger>
            <version>[ignore]</version>
        </fieldNames>
        <!-- 添加自定义level字段，紧跟ts之后 -->
        <customFields>{"level":"%level"}</customFields>
    </encoder>
</appender>

<root level="info">
    <appender-ref ref="json"/>
</root>
</configuration>

调整后的示例输出 #

方案一的输出会符合预期，level紧跟ts之后：

{"ts":"09:13:53.736","level":"INFO","msg":"Loaded default TestExecutionListener class names from location [META-INF/spring.factories]: [org.springframework.test.context.web.ServletTestExecutionListener, org.springframework.test.context.support.DirtiesContextBeforeModesTestExecutionListener, org.springframework.test.context.event.ApplicationEventsTestExecutionListener, org.springframework.test.context.support.DependencyInjectionTestExecutionListener, org.springframework.test.context.support.DirtiesContextTestExecutionListener, org.springframework.test.context.transaction.TransactionalTestExecutionListener, org.springframework.test.context.jdbc.SqlScriptsTestExecutionListener, org.springframework.test.context.event.EventPublishingTestExecutionListener]","logger":"org.springframework.test.context.support.DefaultTestContextBootstrapper"}

内容的提问来源于stack exchange，提问作者Michiel