Graylog REST API Access Logs

log4j2.xml

<?xml version="1.0" encoding="UTF-8"?>
<Configuration packages="org.graylog2.log4j" shutdownHook="disable">
    <Appenders>
        <RollingFile name="AccessLogs" fileName="/tmp/logs/access.log"
                     filePattern="/tmp/logs/access-%d{yyyy-MM-dd-HH-mm}-%i.log.gz">
            <PatternLayout>
                <Pattern>%d %-5p: %c - %m%n</Pattern>
            </PatternLayout>
            <Policies>
                <TimeBasedTriggeringPolicy modulate="true"/>
                <SizeBasedTriggeringPolicy size="50 MB"/>
            </Policies>
            <DefaultRolloverStrategy max="365"/>
        </RollingFile>

        <Console name="STDOUT" target="SYSTEM_OUT">
            <PatternLayout pattern="%d %-5p: %c - %m%n"/>
        </Console>

        <!-- Internal Graylog log appender. Please do not disable. This makes internal log messages available via REST calls. -->
        <Memory name="graylog-internal-logs" bufferSize="500"/>
    </Appenders>
    <Loggers>
        <Logger name="org.graylog2" level="info"/>
        <Logger name="com.github.joschi.jadconfig" level="warn"/>
        <Logger name="org.apache.directory.api.ldap.model.message.BindRequestImpl" level="error"/>
        <Logger name="org.elasticsearch.script" level="warn"/>
        <Logger name="org.graylog2.periodical.VersionCheckThread" level="off"/>
        <Logger name="org.drools.compiler.kie.builder.impl.KieRepositoryImpl" level="warn"/>
        <Logger name="com.joestelmach.natty.Parser" level="warn"/>
        <Logger name="kafka.log.Log" level="warn"/>
        <Logger name="kafka.log.OffsetIndex" level="warn"/>
        <Logger name="org.apache.shiro.session.mgt.AbstractValidatingSessionManager" level="warn"/>

        <!-- Graylog REST API access logs -->
        <Logger name="org.graylog2.rest.accesslog" level="debug" additivity="false">
            <AppenderRef ref="AccessLogs"/>
        </Logger>

        <Root level="warn">
            <AppenderRef ref="STDOUT"/>
            <AppenderRef ref="graylog-internal-logs"/>
        </Root>
    </Loggers>
</Configuration>