Great approach for a gradual migration—here’s how to configure Logback to generate both your existing text-formatted logs (for Splunk) and structured JSON logs (for Kibana) at the same time:

Step 1: Add Required Dependencies #

You’ll need the Logstash Logback encoder to handle JSON formatting cleanly. Add this to your build file:

For Maven (pom.xml): #

<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>7.4</version> <!-- Use the latest stable version -->
</dependency>

For Gradle (build.gradle): #

implementation 'net.logstash.logback:logstash-logback-encoder:7.4'

Step 2: Configure Logback with Dual Appenders #

Update your logback-spring.xml (or logback.xml) to define two separate appenders: one for your existing text logs, and a new one for JSON logs.

Here’s a complete, production-ready configuration example:

<?xml version="1.0" encoding="UTF-8"?>
<configuration scan="true" scanPeriod="30 seconds">
    <!-- Define log path and filenames -->
    <property name="LOG_PATH" value="./logs"/>
    <property name="TEXT_LOG_FILE" value="${LOG_PATH}/application.log"/>
    <property name="JSON_LOG_FILE" value="${LOG_PATH}/application.json.log"/>

    <!-- 1. Existing Text Appender (for Splunk) -->
    <appender name="TEXT_FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>${TEXT_LOG_FILE}</file>
        <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
            <fileNamePattern>${LOG_PATH}/application.%d{yyyy-MM-dd}.%i.log</fileNamePattern>
            <maxFileSize>100MB</maxFileSize>
            <maxHistory>30</maxHistory>
            <totalSizeCap>1GB</totalSizeCap>
        </rollingPolicy>
        <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
            <!-- Keep your existing pattern here to maintain full Splunk compatibility -->
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
        </encoder>
    </appender>

    <!-- 2. New JSON Appender (for Kibana) -->
    <appender name="JSON_FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>${JSON_LOG_FILE}</file>
        <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
            <fileNamePattern>${LOG_PATH}/application.%d{yyyy-MM-dd}.%i.json.log</fileNamePattern>
            <maxFileSize>100MB</maxFileSize>
            <maxHistory>30</maxHistory>
            <totalSizeCap>1GB</totalSizeCap>
        </rollingPolicy>
        <encoder class="net.logstash.logback.encoder.LogstashEncoder">
            <!-- Optional: Add custom metadata for Kibana filtering -->
            <customFields>{"application":"your-app-name","environment":"${spring.profiles.active}"}</customFields>
        </encoder>
    </appender>

    <!-- Root Logger: Route logs to both appenders -->
    <root level="INFO">
        <appender-ref ref="TEXT_FILE"/>
        <appender-ref ref="JSON_FILE"/>
    </root>

    <!-- Optional: Override logging levels for specific packages -->
    <logger name="com.yourproject.package" level="DEBUG" additivity="false">
        <appender-ref ref="TEXT_FILE"/>
        <appender-ref ref="JSON_FILE"/>
    </logger>
</configuration>

Key Notes: #

• Text Appender: This retains your current log format exactly as Splunk expects—no changes needed here, just keep your existing pattern and rolling policy.
• JSON Appender: Uses LogstashEncoder to output structured JSON with standard fields like @timestamp, level, message, logger_name, and thread_name. The customFields let you add app-specific context (like environment or app name) that Kibana will use for easy filtering and visualization.
• Simultaneous Logging: By referencing both appenders in the root logger, every log event is written to both files at the same time.

Verification: #

1. Start your Spring Boot app and check the logs directory—you’ll see both application.log (text format) and application.json.log (JSON format).
2. Confirm Splunk still ingests and processes the text logs correctly.
3. Test the JSON logs with Kibana by setting up a file input (via Filebeat or similar) pointing to the JSON log file.

Migration Next Steps: #

Once your Kibana integration is fully tested:

• Gradually disable the text appender in individual projects (remove the <appender-ref ref="TEXT_FILE"/> lines) as you migrate them to Kibana.
• Keep the text appender enabled for projects still relying on Splunk until you’re ready to fully retire it.

内容的提问来源于stack exchange，提问作者Johny Johnson