ECS/JSON structured logging for Apache OFBiz. - #1443
Open
ashishvijaywargiya wants to merge 16 commits into
Open
Conversation
Adds a JSON appender to log4j2.xml (ECS schema via JsonTemplateLayout), writing runtime/logs/ofbiz-json.log alongside the existing text logs. Off by default; controlled by json.logs.enabled in debug.properties, so the default "./gradlew ofbiz" command picks it up with no extra flag. The JSON template location is a placeholder property (jsonLogTemplateUri / -Dofbiz.json.logs.template) so alternate schemas (Splunk, CloudWatch, etc.) can be added from a custom component without framework changes. ControlFilter now populates requestId/visitId/userLoginId into Log4j2's ThreadContext (MDC) so every log line for a given request or visit can be correlated.
Moves requestId/visitId/userLoginId population out of ControlFilter and into a new engine-level Tomcat Valve (CorrelationValve, registered in CatalinaContainer alongside the existing valves), so it runs ahead of the servlet filter chain instead of inside framework webapp code. ControlFilter/ControlFilterTests are back to their original form. Also adds CorrelationFieldProvider, a ServiceLoader-based extension point: any component can contribute additional correlation fields (e.g. security group, permissions) by implementing the interface and registering it via META-INF/services, with no framework changes. All discovered providers are merged; a provider overwriting a core field is allowed but logged as a warning, and a failing provider is caught and skipped without affecting the request or other providers.
Extends the same config-file-driven pattern already used for json.logs.enabled: adds json.logs.template to debug.properties (default: the bundled ECS template) and has build.gradle read it and always emit -Dofbiz.json.logs.template accordingly. A custom component wanting Splunk/CloudWatch/etc. just points this at its own template's classpath location - no JVM flag, no JAVA_TOOL_OPTIONS, no -PjvmArgs override, and the default "./gradlew ofbiz" command picks it up directly.
…help user to maintain the json files properly and with distinct names.
1) Added log.correlation.userLoginId.mode property (plain/hash/off) in debug.properties controlling whether userLoginId is written raw, as a PBKDF2 digest, or omitted entirely from the structured JSON log correlation context, since userLoginId is often PII such as an email address. 2) Added log.correlation.userLoginId.hash.pepper and log.correlation.userLoginId.hash.keyLengthBits properties, required only when mode=hash, providing the deployment-specific PBKDF2 salt and digest length used when hashing. 3) Updated CorrelationValve to resolve and validate these properties at construction time, failing fast with an IllegalStateException at startup if mode=hash is set without a pepper or with a non-positive key length, instead of failing later on the first login attempt. 4) Implemented hashUserLoginId() in CorrelationValve using PBKDF2WithHmacSHA256 with the same iteration count OFBiz already uses for password storage (security.properties password.encrypt.pbkdf2.iterations), producing a deterministic, non-reversible digest so cross-request correlation still works without exposing the raw userLoginId in logs. 5) Added CorrelationValveTests covering all three modes (plain/hash/off), digest determinism and length, distinct users producing distinct digests, invalid mode falling back to plain, and fail-fast construction errors for a missing pepper or an invalid key length.
ashishvijaywargiya
force-pushed
the
ecs-json-logging
branch
from
August 2, 2026 05:18
33bd76e to
3ee229a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adding the opt-in support of ECS/JSON structured logging for Apache OFBiz.
Grafana-Loki-Promtail
Elasticsearch-Kibana-Filebeat
OpenSearch-OpenSearchDashboards-FluentBit