# Apache Kafka 3.9.0 config/log4j.properties and 4.0.0 config/log4j2.yaml: ConversionPattern "[%d] %p %m (%c)%n"; %d is "yyyy-MM-dd HH:mm:ss,SSS" and the logger closes the line
# Lines from Elastic beats v9.5.5 filebeat/module/kafka/log/test
[2017-08-04 10:48:20,377] INFO starting (kafka.server.KafkaServer) ⇒ {"rule": "kafka", "level": "info", "name": "kafka.server.KafkaServer", "message": "starting", "prefixed": true}
[2017-08-04 10:48:20,748] WARN No meta.properties file under dir /tmp/kafka-logs/meta.properties (kafka.server.BrokerMetadataCheckpoint) ⇒ {"rule": "kafka", "level": "warn", "name": "kafka.server.BrokerMetadataCheckpoint", "message": "No meta.properties file under dir /tmp/kafka-logs/meta.properties"}
[2018-10-17 12:57:18,400] ERROR [ReplicaFetcher replicaId=10, leaderId=30, fetcherId=0] Error for partition test-3-0 at offset 0 (kafka.server.ReplicaFetcherThread) ⇒ {"rule": "kafka+kv", "level": "error", "name": "kafka.server.ReplicaFetcherThread", "message": "[ReplicaFetcher replicaId=10, leaderId=30, fetcherId=0] Error for partition test-3-0 at offset 0"}
[2017-08-04 10:48:21,048] INFO [controller-event-thread]: Starting (kafka.controller.ControllerEventManager$ControllerEventThread) ⇒ {"rule": "kafka", "level": "info", "name": "kafka.controller.ControllerEventManager$ControllerEventThread", "message": "[controller-event-thread]: Starting"}
[2017-08-04 10:48:21,085] DEBUG [Controller 0]: Registering IsrChangeNotificationListener (kafka.controller.KafkaController) ⇒ {"rule": "kafka", "level": "debug", "name": "kafka.controller.KafkaController", "message": "[Controller 0]: Registering IsrChangeNotificationListener"}
[2017-08-04 10:48:21,154] INFO [Replica state machine on controller 0]: Started replica state machine with initial state -> Map() (kafka.controller.ReplicaStateMachine) ⇒ {"rule": "kafka", "level": "info", "name": "kafka.controller.ReplicaStateMachine", "message": "[Replica state machine on controller 0]: Started replica state machine with initial state -> Map()"}
[2017-08-04 10:48:21,165] INFO [Partition state machine on Controller 0]: Invoking state change to OnlinePartition for partitions  (kafka.controller.PartitionStateMachine) ⇒ {"rule": "kafka", "level": "info", "name": "kafka.controller.PartitionStateMachine", "message": "[Partition state machine on Controller 0]: Invoking state change to OnlinePartition for partitions "}
[2017-08-04 11:44:22,588] DEBUG [Controller 0]: Live brokers:  (kafka.controller.KafkaController) ⇒ {"rule": "kafka", "level": "debug", "name": "kafka.controller.KafkaController", "message": "[Controller 0]: Live brokers: "}
[2017-08-04 10:48:21,428] TRACE Controller 0 epoch 1 received response {error_code=0} for a request sent to broker baldur:9092 (id: 0 rack: null) (state.change.logger) ⇒ {"rule": "kafka", "level": "trace", "name": "state.change.logger", "message": "Controller 0 epoch 1 received response {error_code=0} for a request sent to broker baldur:9092 (id: 0 rack: null)"}
[2017-08-04 10:48:20,400] INFO Client environment:java.io.tmpdir=/tmp (org.apache.zookeeper.ZooKeeper) ⇒ {"rule": "kafka", "level": "info", "name": "org.apache.zookeeper.ZooKeeper", "message": "Client environment:java.io.tmpdir=/tmp"}
[2017-08-04 10:48:20,458] INFO zookeeper state changed (SyncConnected) (org.I0Itec.zkclient.ZkClient) ⇒ {"rule": "kafka", "level": "info", "name": "org.I0Itec.zkclient.ZkClient", "message": "zookeeper state changed (SyncConnected)"}
[2018-10-31 15:03:32,474] TRACE [Controller id=10] Checking need to trigger auto leader balancing (kafka.controller.KafkaController) ⇒ {"rule": "kafka+kv", "level": "trace", "name": "kafka.controller.KafkaController", "message": "[Controller id=10] Checking need to trigger auto leader balancing"}
[2018-07-16 10:17:06,489] TRACE [Broker id=30] Cached leader info PartitionState(controllerEpoch=25, leader=-1, leaderEpoch=15, isr=[10], zkVersion=15, replicas=[10], offlineReplicas=[10]) for partition __consumer_offsets-16 in response to UpdateMetadata request sent by controller 20 epoch 25 with correlation id 8 (state.change.logger) ⇒ {"rule": "kafka+kv", "level": "trace", "name": "state.change.logger", "message": "[Broker id=30] Cached leader info PartitionState(controllerEpoch=25, leader=-1, leaderEpoch=15, isr=[10], zkVersion=15, replicas=[10], offlineReplicas=[10]) for partition __consumer_offsets-16 in response to UpdateMetadata request sent by controller 20 epoch 25 with correlation id 8"}
[2018-10-17 12:58:47,490] INFO Terminating process due to signal SIGTERM (org.apache.kafka.common.utils.LoggingSignalHandler) ⇒ {"rule": "kafka", "level": "info", "name": "org.apache.kafka.common.utils.LoggingSignalHandler", "message": "Terminating process due to signal SIGTERM"}
# constructed [2026-10-21 14:03:01,123] FATAL [KafkaServer id=1] Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer) ⇒ {"rule": "kafka+kv", "level": "critical", "name": "kafka.server.KafkaServer", "message": "[KafkaServer id=1] Fatal error during KafkaServer startup. Prepare to shutdown"}
# a message with more lines ends its first line without the logger
# constructed [2026-10-21 14:03:01,123] ERROR Uncaught exception in scheduled task 'flush-log' ⇒ {"rule": "kafka", "level": "error", "name": "", "message": "Uncaught exception in scheduled task 'flush-log'"}
# constructed [2026-10-21 14:03:01,123] WARN [Log partition=pump-0, dir=/var/lib/kafka] Found a corrupted index file (kafka.log.Log) (kafka.log.LogManager) ⇒ {"rule": "kafka", "level": "warn", "name": "kafka.log.LogManager", "message": "[Log partition=pump-0, dir=/var/lib/kafka] Found a corrupted index file (kafka.log.Log)"}
# other layouts of the same stamp read by the layout rule
[2020-04-23 00:28:21,796] [WARN ] [kafka-request-handler-7] [state.change.logger] - [Broker id=1] Ignoring LeaderAndIsr request from controller 1 with correlation id 1 epoch 27 for partition xxx.xxx.inventory.test.1-0-2 since its associated leader epoch 5 is not higher than the current leader epoch 5  ⇒ {"rule": "layout+kv", "level": "warn", "name": "state.change.logger", "message": "[Broker id=1] Ignoring LeaderAndIsr request from controller 1 with correlation id 1 epoch 27 for partition xxx.xxx.inventory.test.1-0-2 since its associated leader epoch 5 is not higher than the current leader epoch 5 "}
# constructed [2026-10-21 14:03:01,123] Info starting (kafka.server.KafkaServer) ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[2026-10-21 14:03:01,123] Info starting (kafka.server.KafkaServer)"}
# constructed [2026-10-21 14:03:01,123] NOTICE starting (kafka.server.KafkaServer) ⇒ {"rule": "layout", "level": "info", "message": "starting (kafka.server.KafkaServer)"}
# constructed [2026-10-21 14:03:01] INFO no milliseconds (kafka.server.KafkaServer) ⇒ {"rule": "layout", "level": "info", "message": "no milliseconds (kafka.server.KafkaServer)"}
# constructed [2026-10-21 14:03:01.123] INFO a dot before the milliseconds (kafka.server.KafkaServer) ⇒ {"rule": "layout", "level": "info", "message": "a dot before the milliseconds (kafka.server.KafkaServer)"}
# constructed [2026-10-21T14:03:01,123] INFO a T in the stamp (kafka.server.KafkaServer) ⇒ {"rule": "layout", "level": "info", "message": "a T in the stamp (kafka.server.KafkaServer)"}
# constructed 2026-10-21 14:03:01,123 INFO no brackets (kafka.server.KafkaServer) ⇒ {"rule": "layout", "level": "info", "message": "no brackets (kafka.server.KafkaServer)"}
# constructed [2026-10-21 14:03:01,123]INFO no space (kafka.server.KafkaServer) ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[2026-10-21 14:03:01,123]INFO no space (kafka.server.KafkaServer)"}
# constructed [2026-10-21 14:03:01,123] starting without a level (kafka.server.KafkaServer) ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[2026-10-21 14:03:01,123] starting without a level (kafka.server.KafkaServer)"}
# constructed [2026-10-21T14:03:01,123][INFO ][o.e.n.Node               ] [node-1] started ⇒ {"rule": "elastic", "level": "info", "name": "o.e.n.Node", "message": "[node-1] started"}
2017-04-07 22:45:30.218 CEST [22603] postgres@mydb ERROR:  operator does not exist: jsonb @> at character 49 ⇒ {"rule": "postgres", "level": "error", "message": "operator does not exist: jsonb @> at character 49"}
