Send Java logs from Log4j 2 or Logback to Logstash

Java logs can reach Logstash directly over the network or through a local file and collector. Choose an appender for the logging backend you actually use: logstash-logback-encoder is for Logback, while Log4j 2 has its own Socket appender and layouts. Log4j 1.x is end-of-life and should not be introduced into a new project.

Option 1: Logback JSON over TCP

For a Logback application, add a compatible encoder release. This is the source example's explicit version, not a recommendation to use an old release in a new deployment:

<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>7.4</version>
</dependency>

Encoder 7.4 requires Logback 1.3 or later. Check the application's managed dependency set before adopting it.

Place this appender inside the Logback configuration and reference it from the relevant root or named logger:

<appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
    <destination>logstash-host:5000</destination>
    <encoder class="net.logstash.logback.encoder.LogstashEncoder"/>
</appender>

On Logstash, receive newline-delimited JSON:

input {
  tcp {
    port => 5000
    codec => json_lines
  }
}

This appender is already asynchronous. Its default full-buffer behavior can drop events; adding another asynchronous wrapper does not provide durable storage.

Option 2: write files and collect them with Filebeat

A file keeps the application's logging path separate from Logstash's availability. For a current Filebeat configuration, use filestream with a stable, unique input ID:

filebeat.inputs:
  - type: filestream
    id: myapp-logs
    paths: [/var/log/myapp/*.log]
output.logstash:
  hosts: ["logstash-host:5044"]

This output uses the Beats protocol, so configure a matching Logstash input rather than sending it to the raw TCP JSON listener above:

input {
  beats {
    port => 5044
  }
}

Configure JSON decoding or multiline handling to match the file's real contents. Files can absorb a temporary backend outage, but only while they remain available and disk capacity, retention, rotation, and collector checkpoints permit recovery. This is not a guarantee against data loss or duplicate delivery.

Option 3: use Log4j 2's Socket appender

Inside a Log4j 2 <Appenders> element, configure a socket and a line-oriented JSON layout:

<Socket name="logstash" host="logstash-host" port="5000" protocol="TCP">
    <JsonLayout compact="true" eventEol="true" properties="true"/>
</Socket>

Attach it with <AppenderRef ref="logstash"/> under the intended logger. JsonLayout needs its documented Jackson runtime dependencies. properties="true" includes Thread Context map fields. JSON Template Layout is another option for a deliberately designed schema, but it has its own module and configuration.

Match the receiving TCP input and JSON framing. Configure TLS and authentication appropriate to the network boundary; a listening port number alone does not define the protocol or secure the connection.

Frequently asked questions

Can I keep Log4j 1.x?

It reached end of life in 2015 and has known security issues. Plan migration to a maintained backend rather than building a new integration around it.

Does direct TCP block application threads?

A synchronous Log4j 2 socket appender can impose network waits or fail writes. Asynchronous logging moves work to a queue, with its own saturation and shutdown behavior. Logback's LogstashTcpSocketAppender is already asynchronous. Check the actual implementation rather than applying one rule to every appender.

How do I include a trace ID?

For SLF4J with Logback, place it in MDC and configure encoder inclusion. For the Log4j 2 API, use ThreadContext.put("traceId", value) and a layout that includes those fields. Instrumentation may inject identifiers for you; verify propagation and remove or restore context at request boundaries. A trace ID field by itself does not create a distributed trace.

References: Logback encoder, Log4j network appenders, and Filebeat filestream.