Some log entries missing

[enisspahi]

Hi,

I am using SplunkHttp appender with log4j2 for my Java console application. In case I am using batch mode (any batch_size_count bigger than 1) some of my entries logged before the shutdown are missing on splunk. For instance I expect to see [INFO ] 2023-12-11 11:35:27.626 [main] ExitCodePrinter - Application finished with exit code=1 but no luck.

The same application has console and file appenders and the log entry is not missing in console and log file.

This is my setup.
Dependency: com.splunk.logging:splunk-library-javalogging:1.11.8.
Log4j2 file:

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="info" name="example" packages="com.splunk.logging">

    <Appenders>

        <SplunkHttp name="http"
                    url="***"
                    token="***"
                    index="***"
                    host="***"
                    sourcetype="log4j"
                    source="***"
                    messageformat="json">
            <errorCallback>com.splunk.logging.util.StandardErrorCallback</errorCallback>
            <JSONLayout compact="true" eventEol="true" stacktraceAsString="true" />
        </SplunkHttp>

        <File name="logfile" fileName="****" createOnDemand="true">
            <PatternLayout pattern="******"/>
        </File>

        <Console name="console" target="SYSTEM_OUT" follow="true">
            <PatternLayout pattern="***" />
        </Console>

    </Appenders>
    <Loggers>
        <Root level="INFO">
            <AppenderRef ref="console"/>
            <AppenderRef ref="logfile"/>
            <AppenderRef ref="http"/>
        </Root>
    </Loggers>

</Configuration>

This issue forces me to use batch_size_count=1 so that I don't loose some important logs. Would be nice being able to use batching due to performance reasons.

[VinayakJamadar]

@enisspahi

In my case logs are only being printed in console, but not pushing logs to Splunk

Here is my log4j2.xml configuration file

<?xml version="1.0" encoding="UTF-8"?> <Configuration status="info" name="example" packages="org.example"> <Appenders> <Console name="console" target="SYSTEM_OUT"> <PatternLayout pattern="%style{%d{ISO8601}} %highlight{%-5level }[%style{%t}{bright,blue}] %style{%C{10}}{bright,yellow}: %msg%n%throwable" /> </Console> <File name="MyFile" fileName="logs/app.log"> <PatternLayout> <Pattern>%d %p %c{1.} [%t] %m%n</Pattern> </PatternLayout> </File> <SplunkHttp name="splunkhttp" url="http://localhost:8088" token="****" host="localhost" index="spring_dev" source="source name" sourcetype="log4j" messageFormat="text" disableCertificateValidation="true"> <PatternLayout pattern="%m"/> </SplunkHttp> </Appenders>

<Loggers>
    <Root level="info">
        <AppenderRef ref="console" />
        <AppenderRef ref="MyFile"/>
        <AppenderRef ref="splunkhttp" />
    </Root>
</Loggers>

Please help

Also, can you share the Dependency of splunk-library-javalogging:1.11.8