Apache Tomcat

Supported Versions

Apache Tomcat versions

Configuration

Option	Description	Log Source
Log Source	Use this field to specify where your logs are coming from. When choosing the 'file' option, the agent reads logs from the log paths specified below. When choosing the 'Kubernetes' options, the agent reads logs from /var/log/containers based on the Pod and Container specified below.	--
Log Format	When choosing the 'default' option, the agent will expect and parse logs in a format that matches the default logging configuration. When choosing the 'observIQ' option, the agent will expect and parse logs in an optimized JSON format that adheres to the observIQ specification.	'file' or 'kubernetes'
Pod Name	Specify the Pod(s) running Apache Tomcat.	'kubernetes'
Container Name	Specify the Container(s) running NGINX. Typically, you can leave this as the default value of (*) and specify the Pod(s) above.	'kubernetes'
Access Logs	Enable and specify the path to the Apache Tomcat Access logs Note: you will only need to specify this path when using choosing 'file' as the Log Source.	'file' or 'kubernetes'
Catalina Logs	Enable and specify the path to the Apache Tomcat Catalina Logs. Note: you will only need to specify this path when using choosing 'file' as the Log Source.	'file' or 'kubernetes'
Start At	Choose whether to start reading from the beginning or end of a file.	'file' or 'kubernetes'

Log Types

Types
tomcat.access
tomcat.catalina

Log Formats

Default: If you're using the default logging configuration for Apache Tomcat, choose the default Log Format option in the Source configuration.

observIQ: For optimal Apache Tomcat parsing and enrichment, we recommend choosing the 'observIQ' log format, and updating your server.xml file using the below steps:

Edit Tomcat's server.xml
Find the org.apache.catalina.valves.AccessLogValve section
Set suffix to ".json"
Set the Log Format listed below (Tomcat uses " in place of double quotes)
Restart Tomcat
Access log files will now use the .json suffix

prefix="localhost_access_log" suffix=".json"
pattern="{
    &quot;remote_host&quot;: &quot;%h&quot;,
    &quot;timestamp&quot;: &quot;%t&quot;,
    &quot;remote_user&quot;: &quot;%u&quot;,
    &quot;user_session_id&quot;: &quot;%S&quot;,
    &quot;method&quot;: &quot;%m&quot;,
    &quot;path&quot;: &quot;%U&quot;,
    &quot;status&quot;: &quot;%s&quot;,
    &quot;bytes_sent&quot;: &quot;%b&quot;,
    &quot;protocol&quot;: &quot;%H&quot;,
    &quot;query&quot;: &quot;%q&quot;,
    &quot;http_x_forwarded_for&quot;: &quot;%{X-Forwarded-For}i&quot;,
    &quot;user_agent&quot;: &quot;%{User-Agent}i&quot;,
    &quot;commit_millis&quot;: &quot;%F&quot;,
    &quot;process_millis&quot;:
    &quot;%D&quot;,
    &quot;thread_name&quot;: &quot;%I&quot;
}"

Example server.xml file:

...
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
  prefix="localhost_access_log" suffix=".json"
  pattern="{
  &quot;remote_host&quot;: &quot;%h&quot;,
  &quot;timestamp&quot;: &quot;%t&quot;,
  &quot;remote_user&quot;: &quot;%u&quot;,
  &quot;user_session_id&quot;: &quot;%S&quot;,
  &quot;method&quot;: &quot;%m&quot;,
  &quot;path&quot;: &quot;%U&quot;,
  &quot;status&quot;: &quot;%s&quot;,
  &quot;bytes_sent&quot;: &quot;%b&quot;,
  &quot;protocol&quot;: &quot;%H&quot;,
  &quot;query&quot;: &quot;%q&quot;,
  &quot;http_x_forwarded_for&quot;: &quot;%{X-Forwarded-For}i&quot;,
  &quot;user_agent&quot;: &quot;%{User-Agent}i&quot;,
  &quot;commit_millis&quot;: &quot;%F&quot;,
  &quot;process_millis&quot;:
  &quot;%D&quot;,
  &quot;thread_name&quot;: &quot;%I&quot;
  }" />
...

Advanced

For more information on the advanced configuration capabilities, see our detailed plugin guide here.