Logging configuration in axonivy engine-cockpit

Oles

Hi, could you please provide suggestions how to configure log4j2 in engine-cockpit in a way that we have @timestamp in European/Copenhagen timezone and not in UTC? Logs also need to be in JSON format with daily file rolling

Here is how the current log looks like:
{"@timestamp":"2026-05-13T15:12:12.316+0200","ecs.version":"1.2.0","log.level":"INFO","message":"REST service rs-aml-case (AML Case API) (2842d8f3-f936-46b7-bc83-1b3777da5a07) call to GET https://service... successful executed in 91 [ms]. Response status was 200 OK","process.thread.name":"ivy scheduled job pool-thread-5 > Poller for process start event bean: TimerBean for External updates (TimerBean) [class=ch.ivyteam.ivy.process.eventstart.beans.TimerBean, pmv=Brave/brave-core$1, path=19C460B7838ABAFF/eventLink.ivp]","log.logger":"runtimelog.Brave.brave-interfaces.rest_client","application":"app_name","dd.service":"axonivy","executionContext":"SYSTEM","pmv":"App$app-interfaces$1","processElement":"197E394D67247D4C-f227","request":"call(239103.289503.0.2)","requestId":"132","securityContext":"BRA","session":"0 SYSTEM","task":"289503"}

My current configuration looks like this

<Configuration status="info">
  <Appenders>
  <Console name="ConsoleLog" target="SYSTEM_OUT">
         <JsonTemplateLayout eventTemplateUri="classpath:EcsLayout.json"/>
  </Console>

    <RollingRandomAccessFile name="IvyLog" fileName="logs/ivy.json" filePattern="logs/ivy-%d{yyyy-MM-dd}.log.gz" ignoreExceptions="false">
        <JsonTemplateLayout eventTemplateUri="classpath:EcsLayout.json"/>

      <Policies>
        <TimeBasedTriggeringPolicy interval="1" modulate="true"/>
        <SizeBasedTriggeringPolicy size="50 MB"/>
      </Policies>

        <DefaultRolloverStrategy max="50">
            <Delete basePath="logs" maxDepth="1">
                <IfLastModified age="P90D"/>           <!-- Delete files that have not been modified in the last 90 days -->
                <IfFileName glob="ivy-*.json"/>   <!-- Match backup files based on pattern -->
            </Delete>
        </DefaultRolloverStrategy>
    </RollingRandomAccessFile>

    <RollingRandomAccessFile name="ConfigLog" fileName="logs/config.json" filePattern="logs/config-%d{yyyy-MM-dd}.json.gz" ignoreExceptions="false">
         <JsonTemplateLayout eventTemplateUri="classpath:EcsLayout.json"/>

        <Policies>
            <TimeBasedTriggeringPolicy />
        </Policies>
        <DefaultRolloverStrategy>
            <Delete basePath="logs" maxDepth="1">
                <IfLastModified age="P180D"/>           <!-- Delete files that have not been modified in the last 180 days -->
                <IfFileName glob="config-*.json"/>      <!-- Match backup files based on pattern -->
            </Delete>
        </DefaultRolloverStrategy>
    </RollingRandomAccessFile>

    <RollingRandomAccessFile name="DeprecationLog" fileName="logs/deprecation.json" filePattern="logs/deprecation-%d{yyyy-MM-dd}.json.gz" ignoreExceptions="false">
         <JsonTemplateLayout eventTemplateUri="classpath:EcsLayout.json"/>

        <Policies>
            <TimeBasedTriggeringPolicy />
        </Policies>
        <DefaultRolloverStrategy>
            <Delete basePath="logs" maxDepth="1">
                <IfLastModified age="P14D"/>                 <!-- Delete files that have not been modified in the last 14 days -->
                <IfFileName glob="deprecation-*.log.gz"/>    <!-- Match backup files based on pattern -->
            </Delete>
        </DefaultRolloverStrategy>
    </RollingRandomAccessFile>

    <RollingRandomAccessFile name="UserSynchLog" fileName="logs/usersynch.json" filePattern="logs/usersynch-%d{yyyy-MM-dd}.json.gz" ignoreExceptions="false">
         <JsonTemplateLayout eventTemplateUri="classpath:EcsLayout.json"/>

        <Policies>
            <TimeBasedTriggeringPolicy />
        </Policies>
        <DefaultRolloverStrategy>
            <Delete basePath="logs" maxDepth="1">
                <IfLastModified age="P28D"/>               <!-- Delete files that have not been modified in the last 28 days -->
                <IfFileName glob="usersynch-*.json"/>    <!-- Match backup files based on pattern -->
            </Delete>
        </DefaultRolloverStrategy>
    </RollingRandomAccessFile>
  </Appenders>

<Loggers>

  <!-- ROOT controls general app logging -->
  <Root level="info" includeLocation="false">
    <AppenderRef ref="IvyLog"/>
    <AppenderRef ref="ConsoleLog"/>
  </Root>

  <!-- FORCE Axon Ivy engine logs to INFO -->
  <Logger name="ch.ivyteam" level="info" additivity="false">
    <AppenderRef ref="IvyLog"/>
    <AppenderRef ref="ConsoleLog"/>
  </Logger>

  <!-- Eclipse runtime (important for Ivy engine) -->
  <Logger name="org.eclipse" level="info" additivity="false">
    <AppenderRef ref="IvyLog"/>
  </Logger>

</Loggers>

</Configuration>

Christian Strebel

Note about your example timestamp

Your sample log already shows:

"@timestamp":"2026-05-13T15:12:12.316+0200"

That is already Copenhagen summer time on May 13, 2026 (+0200, CEST). So if your concern is specifically that logs are in UTC, your sample does not show UTC. It shows a local European offset. If you need to guarantee this consistently, explicitly setting timeZone in the custom template is still the safest option. This is my inference based on the offset shown in your sample. (logging.apache.org)

Custom template

Use a custom JSON event template instead of the stock classpath:EcsLayout.json, and define @timestamp with a timestamp resolver that explicitly sets:

format
timeZone: "Europe/Copenhagen"

Log4j2’s JsonTemplateLayout supports this directly in the event template JSON. (logging.apache.org)

1. Create a custom template file

For example: configuration/log/EcsLayout-Copenhagen.json

{
  "@timestamp": {
    "$resolver": "timestamp",
    "pattern": {
      "format": "yyyy-MM-dd'T'HH:mm:ss.SSSZ",
      "timeZone": "Europe/Copenhagen"
    }
  },
  "ecs.version": "1.2.0",
  "log.level": {
    "$resolver": "level",
    "field": "name"
  },
  "message": {
    "$resolver": "message",
    "stringified": true
  },
  "process.thread.name": {
    "$resolver": "thread",
    "field": "name"
  },
  "log.logger": {
    "$resolver": "logger",
    "field": "name"
  },
  "error.type": {
    "$resolver": "exception",
    "field": "className"
  },
  "error.message": {
    "$resolver": "exception",
    "field": "message"
  },
  "error.stack_trace": {
    "$resolver": "exception",
    "field": "stackTrace",
    "stackTrace": {
      "stringified": true
    }
  },
  "labels": {
    "$resolver": "mdc",
    "flatten": true,
    "stringified": true
  }
}

2. Reference that template from your appenders

Replace:

<JsonTemplateLayout eventTemplateUri="classpath:EcsLayout.json"/>

with something like (make sure you use the absolute path):

<JsonTemplateLayout eventTemplateUri="file:///ivy/configuration/EcsLayout-Copenhagen.json"/>

Christian Strebel

Suggested cleaned-up config

A few fixes in your current config:

IvyLog current filePattern ends in .log.gz although the file content is JSON. Better use .json.gz.
Some Delete globs do not match the actual filePattern:
- IvyLog: glob should match ivy-*.json.gz
- DeprecationLog: currently pattern is .json.gz but delete glob is deprecation-*.log.gz
If you want all logs in JSON, keep JsonTemplateLayout on every appender.

Here is a corrected version:

<Configuration status="info">
  <Appenders>
    <Console name="ConsoleLog" target="SYSTEM_OUT">
      <JsonTemplateLayout eventTemplateUri="file:///ivy/configuration/log/EcsLayout-Copenhagen.json"/>
    </Console>

    <RollingRandomAccessFile
        name="IvyLog"
        fileName="logs/ivy.json"
        filePattern="logs/ivy-%d{yyyy-MM-dd}.json.gz"
        ignoreExceptions="false">
      <JsonTemplateLayout eventTemplateUri="file:///ivy/configuration/log/EcsLayout-Copenhagen.json"/>
      <Policies>
        <TimeBasedTriggeringPolicy interval="1" modulate="true"/>
        <SizeBasedTriggeringPolicy size="50 MB"/>
      </Policies>
      <DefaultRolloverStrategy max="50">
        <Delete basePath="logs" maxDepth="1">
          <IfLastModified age="P90D"/>
          <IfFileName glob="ivy-*.json.gz"/>
        </Delete>
      </DefaultRolloverStrategy>
    </RollingRandomAccessFile>

    <RollingRandomAccessFile
        name="ConfigLog"
        fileName="logs/config.json"
        filePattern="logs/config-%d{yyyy-MM-dd}.json.gz"
        ignoreExceptions="false">
      <JsonTemplateLayout eventTemplateUri="file:///ivy/configuration/log/EcsLayout-Copenhagen.json"/>
      <Policies>
        <TimeBasedTriggeringPolicy interval="1" modulate="true"/>
      </Policies>
      <DefaultRolloverStrategy>
        <Delete basePath="logs" maxDepth="1">
          <IfLastModified age="P180D"/>
          <IfFileName glob="config-*.json.gz"/>
        </Delete>
      </DefaultRolloverStrategy>
    </RollingRandomAccessFile>

    <RollingRandomAccessFile
        name="DeprecationLog"
        fileName="logs/deprecation.json"
        filePattern="logs/deprecation-%d{yyyy-MM-dd}.json.gz"
        ignoreExceptions="false">
      <JsonTemplateLayout eventTemplateUri="file:///ivy/configuration/log/EcsLayout-Copenhagen.json"/>
      <Policies>
        <TimeBasedTriggeringPolicy interval="1" modulate="true"/>
      </Policies>
      <DefaultRolloverStrategy>
        <Delete basePath="logs" maxDepth="1">
          <IfLastModified age="P14D"/>
          <IfFileName glob="deprecation-*.json.gz"/>
        </Delete>
      </DefaultRolloverStrategy>
    </RollingRandomAccessFile>

    <RollingRandomAccessFile
        name="UserSynchLog"
        fileName="logs/usersynch.json"
        filePattern="logs/usersynch-%d{yyyy-MM-dd}.json.gz"
        ignoreExceptions="false">
      <JsonTemplateLayout eventTemplateUri="file:///ivy/configuration/log/EcsLayout-Copenhagen.json"/>
      <Policies>
        <TimeBasedTriggeringPolicy interval="1" modulate="true"/>
      </Policies>
      <DefaultRolloverStrategy>
        <Delete basePath="logs" maxDepth="1">
          <IfLastModified age="P28D"/>
          <IfFileName glob="usersynch-*.json.gz"/>
        </Delete>
      </DefaultRolloverStrategy>
    </RollingRandomAccessFile>
  </Appenders>

  <Loggers>
    <Root level="info" includeLocation="false">
      <AppenderRef ref="IvyLog"/>
      <AppenderRef ref="ConsoleLog"/>
    </Root>

    <Logger name="ch.ivyteam" level="info" additivity="false">
      <AppenderRef ref="IvyLog"/>
      <AppenderRef ref="ConsoleLog"/>
    </Logger>

    <Logger name="org.eclipse" level="info" additivity="false">
      <AppenderRef ref="IvyLog"/>
    </Logger>
  </Loggers>
</Configuration>

Oles

Christian Strebel , thanks for the suggestion, I coppied your corrected version and also added configuration/log/EcsLayout-Copenhagen.json into Dockerfile, but now logs looks like a plain text

This one goes from ivy.json file

No state saving method defined, assuming default server state saving
MyFaces Bean Validation support enabled
No state saving method defined, assuming default server state saving
Converting 'app.yaml' to version YamlVersion[version=11.3.1] using WsdlUrlToCodegen
Converting 'app.yaml' to version YamlVersion[version=11.4.1] using SplitVariableKeysWithDotsToMappings

And this one from console.log

WARNING: CaseQueryUtil.findCaseByAmlCaseId did not find case with id: 407539
WARNING: CaseQueryUtil.findCaseByAmlCaseId did not find case with id: 407545
WARNING: CaseQueryUtil.findCaseByAmlCaseId did not find case with id: 407658

No timestamp at all and is not in JSON format

Christian Strebel

OK, sorry, it looks like you have to specify the absolute file path. For Docker, this would look like this:

<JsonTemplateLayout eventTemplateUri="file:///ivy/configuration/EcsLayout-Copenhagen.json"/>

I have also changed it in the examples above. I hope this helps!

Oles

Christian Strebel , thanks Christian. Now everything good with json format and timestamp.
Also I would like to make sure that files rollover happens on a daily basis, so I hope that the configuration is good and I just need to wait one more day to confirm that. Currently all the files are visible under the current date, and if I select a previous date then none of the files is present