Logback Logstash Tomcat Access JSON Log

Question

Has anybody ever got Tomcat's Access Log as JSON with Logstas Logback Encoder?

Even though it should be possible (according to docs) I am not able to get it workin and I am constantly struggling with Tomcat's classpath hell. Tomcat is throwing NoClassDefFoundErrors even though I am 100% sure the classes must exist on the classpath. It just does not make any sense anymore ...

I put all required JARs into Tomcats lib/ directory, added them to the classpath and set up every config file needed (followed multiple official and unofficial tutorials).

Tomcat's Log (catalina.out -> catalina.json) is working fine with Logstash Logback Encoder, but Tomcat's Access Log is a completly different problem ...

No matter what I tried, every time it resulted in one of those:

NoClassDefFoundError: javax/servlet/ServletContainerInitializer

NoClassDefFoundError: org/apache/catalina/Lifecycle

ClassNotFoundException: ch.qos.logback.access.spi.IAccessEvent

Adding logback-access.jar (in addition to all other logback/slf4j/logstash JARs) to the Classpath via bin/setenv.sh breaks the whole classpath (crash-loop with NoClassDefFoundError: org/apache/catalina/Lifecycle). Adding all other logback/slf4j/logstash JARs without logback-access.jar is working fine (but later results in ClassNotFoundException: ch.qos.logback.access.spi.IAccessEvent but Tomcat is running fine without Access Logs being written) ...

I can't even provide my current state because I don't know what is the most "right" state which is closest to the solution ...

If somebody got Tomcat's Access Log as JSON please tell me how (even if you use a different Encoder).

Already cost me several days of googling, trial and erroring and all my nerves ...

UPDATE

Here is the proof that Tomcat's Classpath or ClassLoading is pretty ****ed up and makes no sense (started JVM with -verbose:class), catalina.out output:

[Loaded ch.qos.logback.access.spi.IAccessEvent from file:/home/tomcat/tomcat_8.5.34/lib/logback-access-1.2.0.jar]

...

java.lang.ClassNotFoundException: ch.qos.logback.access.spi.IAccessEvent

...

The Class must be loaded in another context/Classpath/ClassLoader ... I have no idea how this works ...

Answer 1

I was able to get tomcat access logs in JSON format using the following process:

1) Download and extract tomcat

curl -LO https://downloads.apache.org/tomcat/tomcat-8/v8.5.54/bin/apache-tomcat-8.5.54.tar.gz
tar xvzf apache-tomcat-8.5.54.tar.gz
cd apache-tomcat-8.5.54

2) Install required dependencies into tomcat's lib directory

mvn dependency:copy -Dartifact=net.logstash.logback:logstash-logback-encoder:6.3 -DoutputDirectory=lib
mvn dependency:copy -Dartifact=ch.qos.logback:logback-access:1.2.3 -DoutputDirectory=lib
mvn dependency:copy -Dartifact=ch.qos.logback:logback-core:1.2.3 -DoutputDirectory=lib
mvn dependency:copy -Dartifact=com.fasterxml.jackson.core:jackson-databind:2.10.0 -DoutputDirectory=lib
mvn dependency:copy -Dartifact=com.fasterxml.jackson.core:jackson-core:2.10.0 -DoutputDirectory=lib
mvn dependency:copy -Dartifact=com.fasterxml.jackson.core:jackson-annotations:2.10.0 -DoutputDirectory=lib

3) Configure conf/logback-access.xml

cat <<EOF > conf/logback-access.xml
<configuration>
  <statusListener class="ch.qos.logback.core.status.OnConsoleStatusListener" />  
  <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
    <encoder class="net.logstash.logback.encoder.LogstashAccessEncoder"/>
  </appender>
  <appender-ref ref="STDOUT" />
</configuration>
EOF

4) Configure conf/server.xml.

Add <Valve className="ch.qos.logback.access.tomcat.LogbackValve"/> to the <Host name="localhost" element. For example:

      <Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="true">

        <!-- logback access logs -->
        <Valve className="ch.qos.logback.access.tomcat.LogbackValve"/>

      </Host>

5) Start tomcat

bin/startup.sh

6) After tomcat starts, hit the root url, check the logs, and see the access log entry in json format

$ curl http://localhost:8080/ > /dev/null

$ tail logs/catalina.out 
... snip ...
{"@timestamp":"2020-05-10T18:37:06.157-07:00","@version":"1","message":"127.0.0.1 - - [2020-05-10T18:37:06.157-07:00] \"GET / HTTP/1.1\" 200 -1","method":"GET","protocol":"HTTP/1.1","status_code":200,"requested_url":"GET / HTTP/1.1","requested_uri":"/","remote_host":"127.0.0.1","content_length":-1,"elapsed_time":461}