logback elasticsearch appender missing index in Elasticsearch - spring-boot

I have a Spring Boot application.
I want to send my logs directly from logback to elasticsearch. I'm using Logback Elasticsearch Appender (https://github.com/internetitem/logback-elasticsearch-appender)
The problem is that the index is not created in Elasticsearch. The File appender is working as expected and there are no errors in the logs or anything that shows a misconfiguration.
logback.xml:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
<file>
myApp.log
</file>
<rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
<fileNamePattern>
myApp.%d{yyyy-MM-dd}.log
</fileNamePattern>
<maxHistory>
15
</maxHistory>
</rollingPolicy>
<encoder>
<pattern>
[%d] [%thread] [%-5level] [%class.%method] [user=%mdc{user:-n/d}] - %msg%n%ex{20}
</pattern>
</encoder>
</appender>
<appender name="ELASTIC" class="com.internetitem.logback.elasticsearch.ElasticsearchAppender">
<url>http://localhost:9200/_bulk</url>
<index>dev_myapp-%date{yyyy-MM-dd}</index>
<type>logback</type>
<connectTimeout>30000</connectTimeout> <!-- optional (in ms, default 30000) -->
<errorsToStderr>false</errorsToStderr> <!-- optional (default false) -->
<includeCallerData>false</includeCallerData> <!-- optional (default false) -->
<logsToStderr>false</logsToStderr> <!-- optional (default false) -->
<maxQueueSize>104857600</maxQueueSize> <!-- optional (default 104857600) -->
<maxRetries>3</maxRetries> <!-- optional (default 3) -->
<readTimeout>30000</readTimeout> <!-- optional (in ms, default 30000) -->
<sleepTime>250</sleepTime> <!-- optional (in ms, default 250) -->
<rawJsonMessage>false</rawJsonMessage> <!-- optional (default false) -->
<includeMdc>false</includeMdc> <!-- optional (default false) -->
<maxMessageSize>-1</maxMessageSize> <!-- optional (default -1 -->
<!-- <authentication class="com.internetitem.logback.elasticsearch.config.BasicAuthentication" /> optional -->
<properties>
<property>
<name>severity</name>
<value>%level</value>
</property>
<property>
<name>thread</name>
<value>%thread</value>
</property>
<property>
<name>stacktrace</name>
<value>%ex</value>
</property>
<property>
<name>logger</name>
<value>%logger{16}.%method</value>
</property>
<property>
<name>server-time</name>
<value>%date{ISO8601, America/Costa_Rica}</value>
</property>
</properties>
<headers>
<header>
<name>Content-Type</name>
<value>text/plain</value>
</header>
</headers>
</appender>
<root level="INFO">
<appender-ref ref="FILE" />
<appender-ref ref="ELASTIC" />
</root>
<logger name="com.myCompany.myApp" level="DEBUG" />
<logger name="org.hibernate.hql" level="OFF"/>
<logger name="com.zaxxer.hikari.HikariConfig" level="DEBUG"/>
<logger name="com.zaxxer.hikari.pool.ProxyLeakTask" level="DEBUG"/>
</configuration>
I'd expect to see dev_myapp-2022-01-20 in my local Elasticsearch index, but it's not there.
Elasticsearch is running locally:
curl localhost:9200
{
"name" : "ubuntu-dev-stage-services",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "B0K_ThdDTlWftcVw23_NKA",
"version" : {
"number" : "7.16.3",
"build_flavor" : "default",
"build_type" : "deb",
"build_hash" : "4e6e4eab2297e949ec994e688dad46290d018022",
"build_date" : "2022-01-06T23:43:02.825887787Z",
"build_snapshot" : false,
"lucene_version" : "8.10.1",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
And this are the index in the instance:
curl localhost:9200/_cat/indices
green open .geoip_databases y1revQR7SyWHJIxnAq0z7w 1 0 42 0 40.3mb 40.3mb
green open .kibana_7.16.3_001 zjnnLKjXT362iQdFnXPsHQ 1 0 279 25 2.4mb 2.4mb
green open .apm-custom-link t8-PvRWaTpSd1n2xuT8tYA 1 0 0 0 226b 226b
green open .apm-agent-configuration hx8SsYzkTDqkEPpA7aZcvg 1 0 0 0 226b 226b
green open .kibana_task_manager_7.16.3_001 H-Kjao4hRLW45PmEMTvnGw 1 0 17 11520 1.6mb 1.6mb
green open .tasks Xp2ezFegRo-jzjK4UfUTpQ 1 0 6 0 28.9kb 28.9kb
EDIT
I was able to make it work by using Elasticsearch 5. I'm not sure but looks like the appender does not work with Elasticsearch 7

Related

Application not writing logs on when log file rotates

My app is using spring log4j2 and uses slf4j api to write log to separate log file "application.log". This app gets deployed to tomcat v8 along with other apps. All app share common log4j2 configuration and writes to common logfile 'application.log'. We have a log rotation policy of 250 mb and when the log file rotates the logs are not written to the logfile surprising only one app among all the app is able to write to the log file. I'm able to reproduce this locally too. Can you please help in fixing this issue.
The other
Please find the log4j2.xml config below.
JAR VERSIONS
slf4j-api 1.7.21
log4j-slf4j-impl 2.5
log4j-api 2.5
log4j-core 2.5
log4j-web 2.5
Log4j2.xml
<?xml version="1.0" encoding="UTF-8"?>
<Configuration name="api-config" status="trace" monitorInterval="30">
<Properties>
<Property name="logdir">/Users/kramesan/microservices-config/logs</Property>
</Properties>
<Appenders>
<Console name="STDOUT" target="SYSTEM_OUT">
<PatternLayout pattern="%X{_requestId} %X{authToken} %X{urlEmployeeId} %X{urlCompanyId} [%X{authEmplIds}] [%X{authCompanyIds}] %d{yyy
y-MM-dd HH:mm:ss} %-5p %c{1}:%L - %m%n"/>
</Console>
<RollingFile name="ApplicationLogRollingFile" fileName="${logdir}/application.log"
filePattern="${logdir}/$${date:yyyy-MM}/app-%d{MM-dd-yyyy}-%i.log.gz">
<JSONLayout locationInfo="true" complete="true" compact="true" eventEol="true" properties="true" />
<Policies>
<TimeBasedTriggeringPolicy />
<SizeBasedTriggeringPolicy size="250 MB" />
</Policies>
<DefaultRolloverStrategy max="20" />
</RollingFile>
<RollingFile name="AuditLogRollingFile" fileName="${logdir}/audit/api-audit.log"
filePattern="${logdir}/audit/$${date:yyyy-MM}/api-audit-%d{MM-dd-yyyy}-%i.log.gz">
<PatternLayout>
<Pattern>%X{_requestId} %X{authToken} %X{urlEmployeeId} %X{urlCompanyId} [%X{authEmplIds}] [%X{authCompanyIds}] %m%n</Pattern>
</PatternLayout>
<!-- JSONLayout locationInfo="true" complete="true" compact="true" eventEol="true" properties="true" -->
<Policies>
<TimeBasedTriggeringPolicy />
<SizeBasedTriggeringPolicy size="250 MB" />
</Policies>
<DefaultRolloverStrategy max="20" />
</RollingFile>
<Async name="ApplicationLogAsync" bufferSize="262144">
<AppenderRef ref="ApplicationLogRollingFile"/>
</Async>
<Async name="AuditLogAsync" bufferSize="262144">
<AppenderRef ref="AuditLogRollingFile"/>
</Async>
</Appenders>
<Loggers>
<!-- All the 3rd Party frameworks -->
<Logger name="org.springframework" level="warn" />
<Logger name="org.hibernate" level="warn" />
<!-- common package name for all the business application level code -->
<Logger name="com.trinet" level="info" />
<!-- Audit Loggger This is used for spring aspect to log before and after execution -->
<Logger name="AuditLogger" level="info">
<AppenderRef ref="AuditLogAsync" />
</Logger>
<Root level="info">
<AppenderRef ref="ApplicationLogAsync" />
</Root>
</Loggers>
</Configuration>
Please, edit your Logger name. Logger name property needs package path.
AS-IS
...
<Logger name="AuditLogger" level="info">
...
TO-BE
...
<Logger name="com.foo.bar.AuditLogger" level="info" additivity="false">
...
or
...
<Logger name="com.foo.bar.*" level="info" additivity="false">
...
I think you'd better write property additivity Because your Logger works two times com.foo.bar.AuditLogger Logger and Root Logger. so you additivity to false then it works each.
reference link : Additivity

AWS CloudWatch logging with Spring Boot

What should be the approach to store logs of multiple spring boot application(s) in cloud watch?
Sample spring-boot - logback-spring.xml configuration file is below.
<?xml version="1.0" encoding="UTF-8"?>
<property name="LOGS" value="/logs/abc/" />
<appender name="Console" class="ch.qos.logback.core.ConsoleAppender">
<layout class="ch.qos.logback.classic.PatternLayout">
<Pattern> %black(%d{ISO8601}) %highlight(%-5level) [%blue(%t)] %yellow(%C{1.}): %msg%n%throwable </Pattern>
</layout>
</appender>
<appender name="RollingFile" class="ch.qos.logback.core.rolling.RollingFileAppender">
<file>${LOGS}/abc-log.log</file>
<encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
<Pattern>%d %p %C{1.} [%t] %m%n</Pattern> </encoder>
<rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
<!-- rollover daily and when the file reaches 10 MegaBytes -->
<fileNamePattern>${LOGS}/archived/abc-log-%d{yyyy-MM-dd}.%i.log
</fileNamePattern>
<timeBasedFileNamingAndTriggeringPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedFNATP">
<maxFileSize>5MB</maxFileSize>
</timeBasedFileNamingAndTriggeringPolicy>
<maxHistory>2</maxHistory>
<totalSizeCap>10MB</totalSizeCap>
</rollingPolicy>
</appender>
<!-- LOG everything at INFO level -->
<root level="info">
<appender-ref ref="RollingFile" />
<appender-ref ref="Console" />
</root>
<logger name="com.abc" level="trace" additivity="false">
<appender-ref ref="RollingFile" />
<appender-ref ref="Console" />
</logger>
I was able to achieve the same using Cloudwatch log agent.
Step 1 - Create awslogs.conf file to point to the log location.
[/logs/abcd/8080-abcd.log]
datetime_format = %Y-%m-%d %H:%M:%S
file = /logs/abcd/8080-abcd.log
buffer_duration = 5000
log_stream_name = {hostname}
initial_position = start_of_file
log_group_name = ABCD Group Name
[/logs/defg/8081-defg.log]
datetime_format = %Y-%m-%d %H:%M:%S
file = /logs/abcd/8081-defg.log
buffer_duration = 5000
log_stream_name = {hostname}
initial_position = start_of_file
log_group_name = DEFG Group Name
Step 2 - Install cloud watch log agent as part of UserData/Bootstrap script for ec2.
yum install wget -y
wget https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py
python ./awslogs-agent-setup.py --region $aws_region --non-interactive --configfile=/configlocation/awslogs.conf
Step 3 - Need a role for ec2 machine to create logs in CloudWatch.

Logback to Elasticsearch through yaml or properties

I have many spring based microservice project where I used Logback to Elasticsearch for saving all logs to Elastic search index. I have configured using xml based on some tutorials I got. The configuration is based on xml like as shown below. Instead of xml how can we configure Logback to Elasticsearch using yaml or key value property files.
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<springProperty scope="context" name="microserviceName"
source="spring.application.name" />
<springProperty scope="context" name="profile"
source="spring.profiles.active" />
<springProperty scope="context" name="myESHost"
source="logging.esHost" />
<springProperty scope="context" name="myESPort"
source="logging.esPort" />
<springProperty scope="context" name="myESLoggingLevel"
source="logging.esLoggingLevel" />
<springProperty scope="context" name="consoleLoggingLevel"
source="logging.consoleLoggingLevel" />
<appender name="ELASTIC" class="com.internetitem.logback.elasticsearch.ElasticsearchAppender">
<url>http://${myESHost}:${myESPort}/_bulk</url>
<index>logs-%date{yyyy-MM-dd}</index>
<type>tester</type>
<loggerName>es-logger</loggerName> <!-- optional -->
<errorLoggerName>es-error-logger</errorLoggerName> <!-- optional -->
<connectTimeout>30000</connectTimeout> <!-- optional (in ms, default 30000) -->
<errorsToStderr>false</errorsToStderr> <!-- optional (default false) -->
<includeCallerData>false</includeCallerData> <!-- optional (default false) -->
<logsToStderr>false</logsToStderr> <!-- optional (default false) -->
<maxQueueSize>104857600</maxQueueSize> <!-- optional (default 104857600) -->
<maxRetries>3</maxRetries> <!-- optional (default 3) -->
<readTimeout>30000</readTimeout> <!-- optional (in ms, default 30000) -->
<sleepTime>250</sleepTime> <!-- optional (in ms, default 250) -->
<rawJsonMessage>false</rawJsonMessage> <!-- optional (default false) -->
<includeMdc>false</includeMdc> <!-- optional (default false) -->
<maxMessageSize>100</maxMessageSize> <!-- optional (default -1 -->
<authentication class="com.internetitem.logback.elasticsearch.config.BasicAuthentication" /> <!-- optional -->
<properties>
<property>
<name>host</name>
<value>${HOSTNAME}</value>
<allowEmpty>false</allowEmpty>
</property>
<property>
<name>severity</name>
<value>%level</value>
</property>
<property>
<name>thread</name>
<value>%thread</value>
</property>
<property>
<name>stacktrace</name>
<value>%ex</value>
</property>
<property>
<name>logger</name>
<value>%logger</value>
</property>
</properties>
<headers>
<header>
<name>Content-Type</name>
<value>text/plain</value>
</header>
</headers>
</appender>
<root level="info">
<appender-ref ref="FILELOGGER" />
<appender-ref ref="ELASTIC" />
</root>
<logger name="es-error-logger" level="INFO" additivity="false">
<appender-ref ref="FILELOGGER" />
</logger>
<logger name="es-logger" level="INFO" additivity="false">
<appender name="ES_FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
<!-- ... -->
<encoder>
<pattern>%msg</pattern> <!-- This pattern is important, otherwise it won't be the raw Elasticsearch format anyomre -->
</encoder>
</appender>
</logger>
</configuration>
That is possible. The configuration would go to the application.yml file (see https://springframework.guru/using-yaml-in-spring-boot-to-configure-logback). Having many services to configure this may not be a solution for you as the configuration gets mangled with each services configuration.
To keep things separated you could use groovy (https://springframework.guru/logback-configuration-using-groovy), if you have it, or try to incorporate a logback.yml via external configuration files (https://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-external-config.html) which I have not used yet.

Is it possible to send logs to Logstash

In my Spring Boot app, I am using Logback to write logs to a file in /tmp/myLog.log.
In my app.yml:
logging:
file: /tmp/myLog.log
My logback.xml:
<configuration>
<property name="LOG_FILE" value="${LOG_FILE:-${LOG_PATH:-${LOG_TEMP:-${java.io.tmpdir:-/tmp}}/}spring.log}"/>
<property name="FILE_LOG_PATTERN" value="%d{yyyy-MM-dd HH:mm:ss.SSS} %5p ${PID:- } [%t] --- %-40.40logger{39} : %m%n"/>
<appender name="FILE"
class="ch.qos.logback.core.rolling.RollingFileAppender">
<encoder>
<pattern>${FILE_LOG_PATTERN}</pattern>
</encoder>
<file>${LOG_FILE}</file>
<rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
<fileNamePattern>${LOG_FILE}.%i</fileNamePattern>
</rollingPolicy>
<triggeringPolicy
class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
<MaxFileSize>10MB</MaxFileSize>
</triggeringPolicy>
</appender>
<root level="INFO">
<appender-ref ref="FILE" />
</root>
</configuration>
Then I tell Logstash to look at this log file, in my conf file:
input {
file {
path => "/tmp/myLog.log"
start_position => "beginning"
}
}
output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => json }
}
Now It is looking at this location at myLog.log. Is there a way to send logs to logstash instead of telling it to looking at a location, in my Spring Boot app?
I was successfully playing around with the Logback-Elasticsearch-Appender. You might want to give it a try.

Spring Boot logging pattern

I have a problem with configuration on Logback in a Spring Boot application. I want my consoleAppender to look like the default Spring Boot console appender. How to inherit pattern from Spring Boot default console appender?
Below is my consoleAppender configuration
<appender name="consoleAppender" class="ch.qos.logback.core.ConsoleAppender">
<layout class="ch.qos.logback.classic.PatternLayout">
<Pattern class="org.">
%d{yyyy-MM-dd HH:mm:ss} [%thread] %-5level %logger{36} - %msg%n
</Pattern>
</layout>
</appender>
Once you have included the default configuration, you can use its values in your own logback-spring.xml configuration:
<?xml version="1.0" encoding="UTF-8"?>
<configuration scan="true">
<!-- use Spring default values -->
<include resource="org/springframework/boot/logging/logback/defaults.xml"/>
<appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
<encoder>
<pattern>${CONSOLE_LOG_PATTERN}</pattern>
<charset>utf8</charset>
</encoder>
</appender>
…
</configuration>
You can find Spring Boot logback console logging pattern in defaults.xml file:
spring-boot-1.5.0.RELEASE.jar/org/springframework/boot/logging/logback/defaults.xml
Console pattern:
<property name="CONSOLE_LOG_PATTERN" value="${CONSOLE_LOG_PATTERN:-%clr(%d{yyyy-MM-dd HH:mm:ss.SSS}){faint} %clr(${LOG_LEVEL_PATTERN:-%5p}) %clr(${PID:- }){magenta} %clr(---){faint} %clr([%15.15t]){faint} %clr(%-40.40logger{39}){cyan} %clr(:){faint} %m%n${LOG_EXCEPTION_CONVERSION_WORD:-%wEx}}"/>
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<conversionRule conversionWord="clr" converterClass="org.springframework.boot.logging.logback.ColorConverter" />
<conversionRule conversionWord="wex" converterClass="org.springframework.boot.logging.logback.WhitespaceThrowableProxyConverter" />
<conversionRule conversionWord="wEx" converterClass="org.springframework.boot.logging.logback.ExtendedWhitespaceThrowableProxyConverter" />
<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
<layout class="ch.qos.logback.classic.PatternLayout">
<Pattern>
%clr(%d{yyyy-MM-dd HH:mm:ss.SSS}){faint} %clr(%5p) %clr(${PID:- }){magenta} %clr(---){faint} %clr([%15.15t]){faint} %clr(%-40.40logger{39}){cyan} %clr(:){faint} %m%n%wEx
</Pattern>
</layout>
</appender>
<root level="info">
<appender-ref ref="STDOUT" />
</root>
</configuration>
If you are using application.yml for your config, you can set the logging pattern this way:
logging:
pattern:
console: "%d{yyyy-MM-dd HH:mm:ss} | %-5level | %logger{1.} | %msg%n"
level:
org.springframework: WARN
com.ulisesbocchio.jasyptspringboot: WARN
com.example.test: DEBUG
You can override the logging level on the command line. For example:
$ java -Dlogging.level.com.example.test=TRACE -jar my-example.jar
It's been some time since this question was asked but since I had the problem myself recently and couldn't find an answer I started digging a bit deeper and found a solution that worked for me.
I ended up using the debugger and take a look at the default appenders attached to the logger.
I found this pattern to be working as desired for me:
<pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} %5p 18737 --- [%t] %-40.40logger{39} : %m%n%wEx</pattern>
EDIT: The pattern is not entirely correct, I saw that runtime some values had already been instantiated (in this case 18737 ---) i will look into the proper variable to substitute there. It does contain the format for fixed length columns though
EDIT 2: Ok, I took another look at the debugger contents. This you can also do yourself by looking at the contents of a logger instance:
Debugger(eclipse) Logger Contents
So I ended up using the pattern used in the consoleAppender:
%clr(%d{yyyy-MM-dd HH:mm:ss.SSS}){faint} %clr(%5p) %clr(18971){magenta} %clr(---){faint} %clr([%15.15t]){faint} %clr(%-40.40logger{39}){cyan} %clr(:){faint} %m%n%wEx
As can be seen here:
Debugger: detailed contents of the encoder pattern
Logging pattern can be configured using application.properties file
Example :
# Logging pattern for the console
logging.pattern.console=%d{yyyy-MM-dd HH:mm:ss} - %msg%n
You can use below pattern :
%d{yyyy-MM-dd HH:mm:ss.SSS} %5p ${sys:PID} --- [%15.15t] %-40.40logger{1.} : %m%n%wEx
Note that you can also customize the imported properties.
But beware that at least with spring boot 1.4.3 if you want to customize the properties imported from the defaults.xml, then the customization should be placed BEFORE the include.
For example this customizes the priority to 100 character wide:
<configuration scan="true">
<property name="LOG_LEVEL_PATTERN" value="%100p" />
<!-- use Spring default values -->
<include resource="org/springframework/boot/logging/logback/defaults.xml"/>
<appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
<layout class="ch.qos.logback.classic.PatternLayout">
<Pattern>${CONSOLE_LOG_PATTERN}</Pattern>
</layout>
</appender>
<logger name="hu" level="debug" additivity="false">
<appender-ref ref="CONSOLE" />
</logger>
<root level="warn">
<appender-ref ref="CONSOLE" />
</root>
</configuration>
But this is NOT:
<configuration scan="true">
<!-- use Spring default values -->
<include resource="org/springframework/boot/logging/logback/defaults.xml"/>
<property name="LOG_LEVEL_PATTERN" value="%100p" />
<appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
<layout class="ch.qos.logback.classic.PatternLayout">
<Pattern>${CONSOLE_LOG_PATTERN}</Pattern>
</layout>
</appender>
<logger name="hu" level="debug" additivity="false">
<appender-ref ref="CONSOLE" />
</logger>
<root level="warn">
<appender-ref ref="CONSOLE" />
</root>
</configuration>
For those who'd like to use Łukasz Frankowski's answer (which looks like the cleanest solution here), but in a groovy version, the "problematic" {$PID:- } part can be expanded like in the following:
logback-spring.groovy
import ch.qos.logback.classic.PatternLayout
import ch.qos.logback.core.ConsoleAppender
import org.springframework.boot.logging.logback.ColorConverter
import org.springframework.boot.logging.logback.ExtendedWhitespaceThrowableProxyConverter
import org.springframework.boot.logging.logback.WhitespaceThrowableProxyConverter
import static ch.qos.logback.classic.Level.INFO
conversionRule("clr", ColorConverter)
conversionRule("wex", WhitespaceThrowableProxyConverter)
conversionRule("wEx", ExtendedWhitespaceThrowableProxyConverter)
appender("STDOUT", ConsoleAppender) {
layout(PatternLayout) {
def PID = System.getProperty("PID") ?: ''
pattern = "%clr(%d{yyyy-MM-dd HH:mm:ss.SSS}){faint} %clr(%5p) %clr(${PID}){magenta} %clr(---){faint} %clr([%15.15t]){faint} %clr(%-40.40logger{39}){cyan} %clr(:){faint} %m%n%wEx"
}
}
root(INFO, ["STDOUT"])
This worked for me, adding following line to resources/log4j2.properties file
appender.console.layout.pattern = %d{ISO8601} - info: %msg%n ( your custom pattern goes here )
The spring documentation has an example of the logback.xml that defines the default.
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<include resource="org/springframework/boot/logging/logback/defaults.xml"/>
<include resource="org/springframework/boot/logging/logback/console-appender.xml" />
<root level="INFO">
<appender-ref ref="CONSOLE" />
</root>
<logger name="org.springframework.web" level="DEBUG"/>
</configuration>

Resources