# Elasticsearch v6.8.23 distribution/src/config/log4j2.properties: "[%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n"; 7.x and later add the custom DEPRECATION level
# Logstash v8.15.3 config/log4j2.properties: "[%d{ISO8601}][%-5p][%-25c]%notEmpty{[%X{pipeline.id}]}%notEmpty{[%X{plugin.id}]} %m%n"
# Lines from Elastic beats v9.5.5 filebeat/module/elasticsearch and filebeat/module/logstash tests
[2018-05-17T08:19:35,939][INFO ][o.e.n.Node               ] [] initializing ... ⇒ {"rule": "elastic", "level": "info", "leveled": true, "name": "o.e.n.Node", "message": "[] initializing ...", "prefixed": true}
[2018-05-17T08:19:36,089][INFO ][o.e.e.NodeEnvironment    ] [node_4] using [1] data paths, mounts [[/ (/dev/disk1)]], net usable_space [32.4gb], net total_space [233.5gb], types [apfs] ⇒ {"rule": "elastic", "level": "info", "name": "o.e.e.NodeEnvironment", "message": "[node_4] using [1] data paths, mounts [[/ (/dev/disk1)]], net usable_space [32.4gb], net total_space [233.5gb], types [apfs]"}
[2018-05-17T08:29:12,177][INFO ][o.e.c.m.MetaDataCreateIndexService] [node_4] [test-filebeat-modules] creating index, cause [auto(bulk api)], templates [test-filebeat-modules], shards [5]/[1], mappings [doc] ⇒ {"rule": "elastic", "level": "info", "name": "o.e.c.m.MetaDataCreateIndexService", "message": "[node_4] [test-filebeat-modules] creating index, cause [auto(bulk api)], templates [test-filebeat-modules], shards [5]/[1], mappings [doc]"}
[2021-07-09T10:33:11,962][DEPRECATION][o.e.d.r.RestController   ] [node-1] Legacy index templates are deprecated in favor of composable templates. ⇒ {"rule": "elastic", "level": "warn", "name": "o.e.d.r.RestController", "message": "[node-1] Legacy index templates are deprecated in favor of composable templates."}
[2021-07-09T10:42:03,065][DEPRECATION][o.e.d.c.m.MetadataCreateIndexService] [node-1] index name [.kibana-event-log-7.13.3-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices ⇒ {"rule": "elastic", "level": "warn", "name": "o.e.d.c.m.MetadataCreateIndexService", "message": "[node-1] index name [.kibana-event-log-7.13.3-000001] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices"}
[2021-07-09T10:48:46,329][DEPRECATION][o.e.d.c.m.IndexNameExpressionResolver] [node-1] this request accesses system indices: [.apm-agent-configuration, .apm-custom-link, .async-search, .kibana_7.13.3_001, .kibana_task_manager_7.13.3_001], but in a future major version, direct access to system indices will be prevented by default ⇒ {"rule": "elastic", "level": "warn", "name": "o.e.d.c.m.IndexNameExpressionResolver", "message": "[node-1] this request accesses system indices: [.apm-agent-configuration, .apm-custom-link, .async-search, .kibana_7.13.3_001, .kibana_task_manager_7.13.3_001], but in a future major version, direct access to system indices will be prevented by default"}
[2018-06-29T10:06:14,933][INFO ][index.search.slowlog.query] [v_VJhjV] [metricbeat-6.3.0-2018.06.26][0] took[4.5ms], took_millis[4], total_hits[19435], types[], stats[group1,group2], search_type[QUERY_THEN_FETCH], total_shards[1], source[{"query":{"match_all":{"boost":1.0}}}], ⇒ {"rule": "elastic", "level": "info", "name": "index.search.slowlog.query", "message": "[v_VJhjV] [metricbeat-6.3.0-2018.06.26][0] took[4.5ms], took_millis[4], total_hits[19435], types[], stats[group1,group2], search_type[QUERY_THEN_FETCH], total_shards[1], source[{\"query\":{\"match_all\":{\"boost\":1.0}}}],"}
[2018-06-29T10:06:14,943][INFO ][index.search.slowlog.fetch] [v_VJhjV] [metricbeat-6.3.0-2018.06.26][0] took[10.8ms], took_millis[10], total_hits[19435], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[1], source[{"query":{"match_all":{"boost":1.0}}}], ⇒ {"rule": "elastic", "level": "info", "name": "index.search.slowlog.fetch", "message": "[v_VJhjV] [metricbeat-6.3.0-2018.06.26][0] took[10.8ms], took_millis[10], total_hits[19435], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[1], source[{\"query\":{\"match_all\":{\"boost\":1.0}}}],"}
[2017-10-23T14:20:12,046][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"} ⇒ {"rule": "elastic", "level": "info", "name": "logstash.modules.scaffold", "message": "Initializing module {:module_name=>\"fb_apache\", :directory=>\"/usr/share/logstash/modules/fb_apache/configuration\"}"}
[2017-11-20T03:55:00,318][INFO ][logstash.inputs.jdbc     ] (0.058950s) Select Name as [person.name] ⇒ {"rule": "elastic", "level": "info", "name": "logstash.inputs.jdbc", "message": "(0.058950s) Select Name as [person.name]"}
[2019-11-20T19:04:48,468][ERROR][logstash.outputs.elasticsearch][.monitoring-logstash] Encountered a retryable error. Will Retry with exponential backoff... ⇒ {"rule": "elastic", "level": "error", "name": "logstash.outputs.elasticsearch", "message": "Encountered a retryable error. Will Retry with exponential backoff..."}
[2019-11-20T19:04:48,468][WARN ][org.logstash.dissect.Dissector][the_pipeline_id] Dissector mapping, pattern not found {"field"=>"message", "pattern"=>"%{LogLineTimeStamp->}\t%{Healthy}\t%{Fatals}\t%{Errors}\t%{Warnings}\t%{TimeToBuildPatternsCache}\t%{CachedPatternsCount}\t%{MessagesEnqueued}\t%{DropMsgNoSubscribers}\t%{MessagesEnqueued}\t%{TotalDests}\t%{CycleProcTime}\t%{TimeSinceNap}\t%{QUtilPermilAvg}\t%{QUtilPermilMax}\t%{QUtilPermilCount}\t%{NotifierRequests}\t%{NotifierProcessedRequests}\t%{NotifierRequestsChangeDynamicSubs}\t%{NotifierSentRequestsChangeExtDynamicSubs}\t%{NotifierProcessedRequestsDropped}\t%{NotifierBadTargets}\t%{NotifierCycleTimeNetAvg}\t%{NotifierCycleTimeNetCount}\t%{NotifierUtilAvg->}", "event"=>{"fields"=>{"pipeline"=>"mypipeline", "indexprefix"=>"idx", "regid"=>"w", "env"=>"production"}, "beat"=>{"version"=>"6.8.3", "hostname"=>"myhostname", "name"=>"myname"}, "message"=>"msg", "tags"=>["production", "beats_input_codec_plain_applied"], "host"=>{"name"=>"myhostname"}}} ⇒ {"rule": "elastic", "level": "warn", "name": "org.logstash.dissect.Dissector", "message": "Dissector mapping, pattern not found {\"field\"=>\"message\", \"pattern\"=>\"%{LogLineTimeStamp->}\\t%{Healthy}\\t%{Fatals}\\t%{Errors}\\t%{Warnings}\\t%{TimeToBuildPatternsCache}\\t%{CachedPatternsCount}\\t%{MessagesEnqueued}\\t%{DropMsgNoSubscribers}\\t%{MessagesEnqueued}\\t%{TotalDests}\\t%{CycleProcTime}\\t%{TimeSinceNap}\\t%{QUtilPermilAvg}\\t%{QUtilPermilMax}\\t%{QUtilPermilCount}\\t%{NotifierRequests}\\t%{NotifierProcessedRequests}\\t%{NotifierRequestsChangeDynamicSubs}\\t%{NotifierSentRequestsChangeExtDynamicSubs}\\t%{NotifierProcessedRequestsDropped}\\t%{NotifierBadTargets}\\t%{NotifierCycleTimeNetAvg}\\t%{NotifierCycleTimeNetCount}\\t%{NotifierUtilAvg->}\", \"event\"=>{\"fields\"=>{\"pipeline\"=>\"mypipeline\", \"indexprefix\"=>\"idx\", \"regid\"=>\"w\", \"env\"=>\"production\"}, \"beat\"=>{\"version\"=>\"6.8.3\", \"hostname\"=>\"myhostname\", \"name\"=>\"myname\"}, \"message\"=>\"msg\", \"tags\"=>[\"production\", \"beats_input_codec_plain_applied\"], \"host\"=>{\"name\"=>\"myhostname\"}}}"}
[2017-10-30T09:57:58,243][WARN ][slowlog.logstash.filters.sleep] event processing time {:plugin_params=>{"time"=>3, "id"=>"e4e12a4e3082615c5427079bf4250dbfa338ebac10f8ea9912d7b98a14f56b8c"}, :took_in_nanos=>3027675106, :took_in_millis=>3027, :event=>"{\"@version\":\"1\",\"@timestamp\":\"2017-10-30T13:57:55.130Z\",\"host\":\"sashimi\",\"sequence\":0,\"message\":\"Hello world!\"}"} ⇒ {"rule": "elastic", "level": "warn", "name": "slowlog.logstash.filters.sleep", "message": "event processing time {:plugin_params=>{\"time\"=>3, \"id\"=>\"e4e12a4e3082615c5427079bf4250dbfa338ebac10f8ea9912d7b98a14f56b8c\"}, :took_in_nanos=>3027675106, :took_in_millis=>3027, :event=>\"{\\\"@version\\\":\\\"1\\\",\\\"@timestamp\\\":\\\"2017-10-30T13:57:55.130Z\\\",\\\"host\\\":\\\"sashimi\\\",\\\"sequence\\\":0,\\\"message\\\":\\\"Hello world!\\\"}\"}"}
# constructed [2026-10-21T14:03:01,123][DEBUG][o.e.c.s.MasterService    ] [bench-1] took [12ms] to compute cluster state ⇒ {"rule": "elastic", "level": "debug", "name": "o.e.c.s.MasterService", "message": "[bench-1] took [12ms] to compute cluster state"}
# constructed [2026-10-21T14:03:01,123][TRACE][o.e.t.TransportService   ] [bench-1] sent request [7] ⇒ {"rule": "elastic", "level": "trace", "name": "o.e.t.TransportService", "message": "[bench-1] sent request [7]"}
# constructed [2026-10-21T14:03:01,123][FATAL][o.e.b.ElasticsearchUncaughtExceptionHandler] [bench-1] fatal error in thread [main], exiting ⇒ {"rule": "elastic", "level": "critical", "name": "o.e.b.ElasticsearchUncaughtExceptionHandler", "message": "[bench-1] fatal error in thread [main], exiting"}
# the levels log4j and Elasticsearch define, the brackets and the ISO stamp with a comma
# constructed [2026-10-21T14:03:01,123][CRITICAL][o.e.d.r.RestController   ] [bench-1] a deprecation, not a failure ⇒ {"rule": "elastic", "level": "warn", "leveled": true, "name": "o.e.d.r.RestController", "message": "[bench-1] a deprecation, not a failure"}
# constructed [2026-10-21T14:03:01,123][NOTICE][o.e.n.Node               ] not a log4j level ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[2026-10-21T14:03:01,123][NOTICE][o.e.n.Node               ] not a log4j level"}
# constructed [2026-10-21T14:03:01,123][CRITICALLY][o.e.n.Node] not a level word ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[2026-10-21T14:03:01,123][CRITICALLY][o.e.n.Node] not a level word"}
# constructed [2026-10-21T14:03:01,123][info ][o.e.n.Node               ] lower case ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[2026-10-21T14:03:01,123][info ][o.e.n.Node               ] lower case"}
# constructed [2026-10-21T14:03:01.123][INFO ][o.e.n.Node               ] a dot before the milliseconds ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[2026-10-21T14:03:01.123][INFO ][o.e.n.Node               ] a dot before the milliseconds"}
# constructed [2026-10-21 14:03:01,123][INFO ][o.e.n.Node               ] a space in the stamp ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[2026-10-21 14:03:01,123][INFO ][o.e.n.Node               ] a space in the stamp"}
# constructed [2026-10-21T14:03:01,123] [INFO ] [o.e.n.Node] spaced brackets ⇒ {"rule": "layout", "level": "info", "name": "o.e.n.Node", "message": "spaced brackets"}
# constructed [2026-10-21T14:03:01,123][INFO ][o.e.n.Node]no space ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[2026-10-21T14:03:01,123][INFO ][o.e.n.Node]no space"}
# constructed [2026-10-21T14:03:01,123][INFO ] no logger ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[2026-10-21T14:03:01,123][INFO ] no logger"}
[2017-08-04 10:48:20,377] INFO starting (kafka.server.KafkaServer) ⇒ {"rule": "kafka", "level": "info", "name": "kafka.server.KafkaServer", "message": "starting"}
# constructed {"type": "server", "timestamp": "2019-01-30T14:16:20,233-0800", "level": "INFO", "component": "o.e.n.Node", "cluster.name": "es1", "node.name": "node-1", "message": "started" } ⇒ {"rule": "json", "level": "info", "message": "started"}
# Elasticsearch 7.x DeprecationLogger.java: CRITICAL is "More serious that WARN by 1, but less serious
# than ERROR"
# constructed [2024-01-01T10:00:00,000][CRITICAL][o.e.d.c.m.MetadataCreateIndexService] [node-1] index name [.pumps] starts with a dot ⇒ {"rule": "elastic", "level": "warn", "leveled": true, "name": "o.e.d.c.m.MetadataCreateIndexService", "message": "[node-1] index name [.pumps] starts with a dot"}
