Logs watchdog events JSON-formatted

to log files.
Provides a Logstash/ElasticSearch-ready log source.

Drupal 7, 8 and 9 compatible.

All Core versions have a stable release and work in a similar way using the same configurable settings as listed below. See Drupal 9 compatibility report concerning D9.

Settings overridable by server environment vars

to secure simple and safe centralized configuration of multiple sites/hosts.
Just SetEnv drupal_[Drupal conf var] '[value]'.

jsonlog_severity_threshold: defaults to warning
jsonlog_truncate: defaults to 64 (Kb), logger uses file locking
jsonlog_site_id: defaults to server's hostname + database name + database prefix (if any))
jsonlog_canonical: name; for site identification across multiple instances
jsonlog_dir: defaults to PHP:ini error_log (unless that is 'syslog', then checks the usual suspects /var/log/...) + /drupal-jsonlog
jsonlog_file_time: none | Ymd (default) | YW | Ym
jsonlog_newline_prepend: bool|null (version >=8.x-1.3 only)
jsonlog_tags: comma-separated list; server env var + Drupal conf var

Beware that versions >=8.x-2.* defaults to append newline to log entry instead of prepending.

JSON log fields

@timestamp: ISO-8601 milliseconds timestamp instead of watchdog's native seconds timestamp
@version: (always) 1
message_id: jsonlog site ID + unique padding
site_id: (default) server's hostname + database name + database prefix (if any)
canonical: name; for site identification across multiple instances (default empty)
tags: comma-separated list; becomes array
type: always 'drupal'
subtype: drupal watchdog type
severity: (string) error is 'error', not 3
method: HTTP request method, or 'cli' (if drush)
request_uri
referer
uid
username: name of current user, or empty (deprecated >=8.x-2.*)
client_ip: equivalent to watchdog standard 'ip' field
link
code: integer if watchdog 'link' is N or 'N'
variables: always null, watchdog variables gets parsed into message
trunc: null if the log entry as a whole doesn't exceed the json_truncate setting; otherwise array of original length, truncated length

Pros & cons versus dblog and syslog

Original concept

and continued source of inspiration: Klavs Klavsen (klavs).

Sponsorship

JSONlog D7 is sponsored by Københavns Kommune, Koncernservice (Copenhagen Municipality, Corporate Services). D8 version is sponsored by Cegeka and VDAB.

Documentation (D7)

phpdoc Doxygen dialect

Requirements

D7: PHP 5.3+
D8: PHP 7+
no module dependencies

RTBC issues for JSONlog

Filters