# Log4j - audit logs - console filter

**URL:** <https://forum.opensearch.org/t/log4j-audit-logs-console-filter/21648>\
**Category:** OpenSearch\
**Tags:** troubleshoot\
**Created:** [September 26, 2024, 6:55pm UTC](https://forum.opensearch.org/t/log4j-audit-logs-console-filter/21648 "2024-09-26T18:55:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mvrk](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/mvrk/32/8176_2.png) [@mvrk](https://forum.opensearch.org/u/mvrk)\
**Post date:** [September 26, 2024, 6:55pm UTC](https://forum.opensearch.org/t/log4j-audit-logs-console-filter/21648/1 "2024-09-26T18:55:46Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
OpenSearch: 2.15.0  
Kubernetes: 1.30  
OS: Debian 12 (bookworm)  
Kernel: 6.6.47+rpt-rpi-2712 aarch64  
Hardware: RPI5  
RAM: 8GB

**Describe the issue** :  
Hi, i configured the audit logs to be sent to log4j with debug level, then i configured log4j2.properties to write them to a file, but they show up on the console as well, anyone knows how to make log4j write the audit logs only to file instead of console and file?

**Configuration** :  
opensearch.yml:  
plugins.security.audit.type: log4j  
plugins.security.audit.config.log4j.logger\_name: audit  
plugins.security.audit.config.log4j.level: DEBUG

log4j2.properties:

status = error

appender.console.type = Console  
appender.console.name = console  
appender.console.layout.type = PatternLayout  
appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node\_name]%marker %m%n

######## Server JSON ############################  
appender.rolling.type = RollingFile  
appender.rolling.name = rolling  
appender.rolling.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}\_server.json  
appender.rolling.filePermissions = rw-r-----  
appender.rolling.layout.type = OpenSearchJsonLayout  
appender.rolling.layout.type\_name = server

appender.rolling.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}-%d{yyyy-MM-dd}-%i.json.gz  
appender.rolling.policies.type = Policies  
appender.rolling.policies.time.type = TimeBasedTriggeringPolicy  
appender.rolling.policies.time.interval = 1  
appender.rolling.policies.time.modulate = true  
appender.rolling.policies.size.type = SizeBasedTriggeringPolicy  
appender.rolling.policies.size.size = 128MB  
appender.rolling.strategy.type = DefaultRolloverStrategy  
appender.rolling.strategy.fileIndex = nomax  
appender.rolling.strategy.action.type = Delete  
appender.rolling.strategy.action.basepath = ${sys:opensearch.logs.base\_path}  
appender.rolling.strategy.action.condition.type = IfFileName  
appender.rolling.strategy.action.condition.glob = ${sys:opensearch.logs.cluster\_name}-\*  
appender.rolling.strategy.action.condition.nested\_condition.type = IfAccumulatedFileSize  
appender.rolling.strategy.action.condition.nested\_condition.exceeds = 2GB  
################################################  
######## Server - old style pattern ###########  
appender.rolling\_old.type = RollingFile  
appender.rolling\_old.name = rolling\_old  
appender.rolling\_old.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}.log  
appender.rolling\_old.filePermissions = rw-r-----  
appender.rolling\_old.layout.type = PatternLayout  
appender.rolling\_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node\_name]%marker %m%n

appender.rolling\_old.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}-%d{yyyy-MM-dd}-%i.log.gz  
appender.rolling\_old.policies.type = Policies  
appender.rolling\_old.policies.time.type = TimeBasedTriggeringPolicy  
appender.rolling\_old.policies.time.interval = 1  
appender.rolling\_old.policies.time.modulate = true  
appender.rolling\_old.policies.size.type = SizeBasedTriggeringPolicy  
appender.rolling\_old.policies.size.size = 128MB  
appender.rolling\_old.strategy.type = DefaultRolloverStrategy  
appender.rolling\_old.strategy.fileIndex = nomax  
appender.rolling\_old.strategy.action.type = Delete  
appender.rolling\_old.strategy.action.basepath = ${sys:opensearch.logs.base\_path}  
appender.rolling\_old.strategy.action.condition.type = IfFileName  
appender.rolling\_old.strategy.action.condition.glob = ${sys:opensearch.logs.cluster\_name}-\*  
appender.rolling\_old.strategy.action.condition.nested\_condition.type = IfAccumulatedFileSize  
appender.rolling\_old.strategy.action.condition.nested\_condition.exceeds = 2GB  
################################################

rootLogger.level = info  
rootLogger.appenderRef.console.ref = console  
rootLogger.appenderRef.rolling.ref = rolling  
rootLogger.appenderRef.rolling\_old.ref = rolling\_old

######## Deprecation JSON #######################  
appender.deprecation\_rolling.type = RollingFile  
appender.deprecation\_rolling.name = deprecation\_rolling  
appender.deprecation\_rolling.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}\_deprecation.json  
appender.deprecation\_rolling.filePermissions = rw-r-----  
appender.deprecation\_rolling.layout.type = OpenSearchJsonLayout  
appender.deprecation\_rolling.layout.type\_name = deprecation  
appender.deprecation\_rolling.layout.opensearchmessagefields=x-opaque-id  
appender.deprecation\_rolling.filter.rate\_limit.type = RateLimitingFilter

appender.deprecation\_rolling.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}\_deprecation-%i.json.gz  
appender.deprecation\_rolling.policies.type = Policies  
appender.deprecation\_rolling.policies.size.type = SizeBasedTriggeringPolicy  
appender.deprecation\_rolling.policies.size.size = 1GB  
appender.deprecation\_rolling.strategy.type = DefaultRolloverStrategy  
appender.deprecation\_rolling.strategy.max = 4

appender.header\_warning.type = HeaderWarningAppender  
appender.header\_warning.name = header\_warning  
#################################################  
######## Deprecation - old style pattern #######  
appender.deprecation\_rolling\_old.type = RollingFile  
appender.deprecation\_rolling\_old.name = deprecation\_rolling\_old  
appender.deprecation\_rolling\_old.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}\_deprecation.log  
appender.deprecation\_rolling\_old.filePermissions = rw-r-----  
appender.deprecation\_rolling\_old.layout.type = PatternLayout  
appender.deprecation\_rolling\_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node\_name]%marker %m%n

appender.deprecation\_rolling\_old.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}  
\_deprecation-%i.log.gz  
appender.deprecation\_rolling\_old.policies.type = Policies  
appender.deprecation\_rolling\_old.policies.size.type = SizeBasedTriggeringPolicy  
appender.deprecation\_rolling\_old.policies.size.size = 1GB  
appender.deprecation\_rolling\_old.strategy.type = DefaultRolloverStrategy  
appender.deprecation\_rolling\_old.strategy.max = 4  
#################################################  
logger.deprecation.name = org.opensearch.deprecation  
logger.deprecation.level = deprecation  
logger.deprecation.appenderRef.deprecation\_rolling.ref = deprecation\_rolling  
logger.deprecation.appenderRef.deprecation\_rolling\_old.ref = deprecation\_rolling\_old  
logger.deprecation.appenderRef.header\_warning.ref = header\_warning  
logger.deprecation.additivity = false

######## Search Request Slowlog JSON ####################  
appender.search\_request\_slowlog\_json\_appender.type = RollingFile  
appender.search\_request\_slowlog\_json\_appender.name = search\_request\_slowlog\_json\_appender  
appender.search\_request\_slowlog\_json\_appender.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs  
.cluster\_name}\_index\_search\_slowlog.json  
appender.search\_request\_slowlog\_json\_appender.filePermissions = rw-r-----  
appender.search\_request\_slowlog\_json\_appender.layout.type = OpenSearchJsonLayout  
appender.search\_request\_slowlog\_json\_appender.layout.type\_name = search\_request\_slowlog  
appender.search\_request\_slowlog\_json\_appender.layout.opensearchmessagefields=message,took,took\_millis,phase\_took,total\_hits,search\_type,shards,source,id

appender.search\_request\_slowlog\_json\_appender.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs  
.cluster\_name}\_index\_search\_slowlog-%i.json.gz  
appender.search\_request\_slowlog\_json\_appender.policies.type = Policies  
appender.search\_request\_slowlog\_json\_appender.policies.size.type = SizeBasedTriggeringPolicy  
appender.search\_request\_slowlog\_json\_appender.policies.size.size = 1GB  
appender.search\_request\_slowlog\_json\_appender.strategy.type = DefaultRolloverStrategy  
appender.search\_request\_slowlog\_json\_appender.strategy.max = 4  
#################################################  
######## Search Request Slowlog Log File - old style pattern ####  
appender.search\_request\_slowlog\_log\_appender.type = RollingFile  
appender.search\_request\_slowlog\_log\_appender.name = search\_request\_slowlog\_log\_appender  
appender.search\_request\_slowlog\_log\_appender.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}  
\_index\_search\_slowlog.log  
appender.search\_request\_slowlog\_log\_appender.filePermissions = rw-r-----  
appender.search\_request\_slowlog\_log\_appender.layout.type = PatternLayout  
appender.search\_request\_slowlog\_log\_appender.layout.pattern = [%d{ISO8601}][%-5p][%c{1.}] [%node\_name]%marker %m%n

appender.search\_request\_slowlog\_log\_appender.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}  
\_index\_search\_slowlog-%i.log.gz  
appender.search\_request\_slowlog\_log\_appender.policies.type = Policies  
appender.search\_request\_slowlog\_log\_appender.policies.size.type = SizeBasedTriggeringPolicy  
appender.search\_request\_slowlog\_log\_appender.policies.size.size = 1GB  
appender.search\_request\_slowlog\_log\_appender.strategy.type = DefaultRolloverStrategy  
appender.search\_request\_slowlog\_log\_appender.strategy.max = 4  
#################################################  
logger.search\_request\_slowlog\_logger.name = cluster.search.request.slowlog  
logger.search\_request\_slowlog\_logger.level = trace  
logger.search\_request\_slowlog\_logger.appenderRef.search\_request\_slowlog\_json\_appender.ref = search\_request\_slowlog\_json\_appender  
logger.search\_request\_slowlog\_logger.appenderRef.search\_request\_slowlog\_log\_appender.ref = search\_request\_slowlog\_log\_appender  
logger.search\_request\_slowlog\_logger.additivity = false

######## Search slowlog JSON ####################  
appender.index\_search\_slowlog\_rolling.type = RollingFile  
appender.index\_search\_slowlog\_rolling.name = index\_search\_slowlog\_rolling  
appender.index\_search\_slowlog\_rolling.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs  
.cluster\_name}\_index\_search\_slowlog.json  
appender.index\_search\_slowlog\_rolling.filePermissions = rw-r-----  
appender.index\_search\_slowlog\_rolling.layout.type = OpenSearchJsonLayout  
appender.index\_search\_slowlog\_rolling.layout.type\_name = index\_search\_slowlog  
appender.index\_search\_slowlog\_rolling.layout.opensearchmessagefields=message,took,took\_millis,total\_hits,types,stats,search\_type,total\_shards,source,id

appender.index\_search\_slowlog\_rolling.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs  
.cluster\_name}\_index\_search\_slowlog-%i.json.gz  
appender.index\_search\_slowlog\_rolling.policies.type = Policies  
appender.index\_search\_slowlog\_rolling.policies.size.type = SizeBasedTriggeringPolicy  
appender.index\_search\_slowlog\_rolling.policies.size.size = 1GB  
appender.index\_search\_slowlog\_rolling.strategy.type = DefaultRolloverStrategy  
appender.index\_search\_slowlog\_rolling.strategy.max = 4  
#################################################  
######## Search slowlog - old style pattern ####  
appender.index\_search\_slowlog\_rolling\_old.type = RollingFile  
appender.index\_search\_slowlog\_rolling\_old.name = index\_search\_slowlog\_rolling\_old  
appender.index\_search\_slowlog\_rolling\_old.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}  
\_index\_search\_slowlog.log  
appender.index\_search\_slowlog\_rolling\_old.filePermissions = rw-r-----  
appender.index\_search\_slowlog\_rolling\_old.layout.type = PatternLayout  
appender.index\_search\_slowlog\_rolling\_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node\_name]%marker %m%n

appender.index\_search\_slowlog\_rolling\_old.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}  
\_index\_search\_slowlog-%i.log.gz  
appender.index\_search\_slowlog\_rolling\_old.policies.type = Policies  
appender.index\_search\_slowlog\_rolling\_old.policies.size.type = SizeBasedTriggeringPolicy  
appender.index\_search\_slowlog\_rolling\_old.policies.size.size = 1GB  
appender.index\_search\_slowlog\_rolling\_old.strategy.type = DefaultRolloverStrategy  
appender.index\_search\_slowlog\_rolling\_old.strategy.max = 4  
#################################################  
logger.index\_search\_slowlog\_rolling.name = index.search.slowlog  
logger.index\_search\_slowlog\_rolling.level = trace  
logger.index\_search\_slowlog\_rolling.appenderRef.index\_search\_slowlog\_rolling.ref = index\_search\_slowlog\_rolling  
logger.index\_search\_slowlog\_rolling.appenderRef.index\_search\_slowlog\_rolling\_old.ref = index\_search\_slowlog\_rolling\_old  
logger.index\_search\_slowlog\_rolling.additivity = false

######## Indexing slowlog JSON ##################  
appender.index\_indexing\_slowlog\_rolling.type = RollingFile  
appender.index\_indexing\_slowlog\_rolling.name = index\_indexing\_slowlog\_rolling  
appender.index\_indexing\_slowlog\_rolling.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}  
\_index\_indexing\_slowlog.json  
appender.index\_indexing\_slowlog\_rolling.filePermissions = rw-r-----  
appender.index\_indexing\_slowlog\_rolling.layout.type = OpenSearchJsonLayout  
appender.index\_indexing\_slowlog\_rolling.layout.type\_name = index\_indexing\_slowlog  
appender.index\_indexing\_slowlog\_rolling.layout.opensearchmessagefields=message,took,took\_millis,doc\_type,id,routing,source

appender.index\_indexing\_slowlog\_rolling.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}  
\_index\_indexing\_slowlog-%i.json.gz  
appender.index\_indexing\_slowlog\_rolling.policies.type = Policies  
appender.index\_indexing\_slowlog\_rolling.policies.size.type = SizeBasedTriggeringPolicy  
appender.index\_indexing\_slowlog\_rolling.policies.size.size = 1GB  
appender.index\_indexing\_slowlog\_rolling.strategy.type = DefaultRolloverStrategy  
appender.index\_indexing\_slowlog\_rolling.strategy.max = 4  
#################################################  
######## Indexing slowlog - old style pattern ##  
appender.index\_indexing\_slowlog\_rolling\_old.type = RollingFile  
appender.index\_indexing\_slowlog\_rolling\_old.name = index\_indexing\_slowlog\_rolling\_old  
appender.index\_indexing\_slowlog\_rolling\_old.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}  
\_index\_indexing\_slowlog.log  
appender.index\_indexing\_slowlog\_rolling\_old.filePermissions = rw-r-----  
appender.index\_indexing\_slowlog\_rolling\_old.layout.type = PatternLayout  
appender.index\_indexing\_slowlog\_rolling\_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node\_name]%marker %m%n

appender.index\_indexing\_slowlog\_rolling\_old.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}  
\_index\_indexing\_slowlog-%i.log.gz  
appender.index\_indexing\_slowlog\_rolling\_old.policies.type = Policies  
appender.index\_indexing\_slowlog\_rolling\_old.policies.size.type = SizeBasedTriggeringPolicy  
appender.index\_indexing\_slowlog\_rolling\_old.policies.size.size = 1GB  
appender.index\_indexing\_slowlog\_rolling\_old.strategy.type = DefaultRolloverStrategy  
appender.index\_indexing\_slowlog\_rolling\_old.strategy.max = 4  
#################################################

logger.index\_indexing\_slowlog.name = index.indexing.slowlog.index  
logger.index\_indexing\_slowlog.level = trace  
logger.index\_indexing\_slowlog.appenderRef.index\_indexing\_slowlog\_rolling.ref = index\_indexing\_slowlog\_rolling  
logger.index\_indexing\_slowlog.appenderRef.index\_indexing\_slowlog\_rolling\_old.ref = index\_indexing\_slowlog\_rolling\_old  
logger.index\_indexing\_slowlog.additivity = false

######## Task details log JSON ####################  
appender.task\_detailslog\_rolling.type = RollingFile  
appender.task\_detailslog\_rolling.name = task\_detailslog\_rolling  
appender.task\_detailslog\_rolling.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}\_task\_detailslog.json  
appender.task\_detailslog\_rolling.filePermissions = rw-r-----  
appender.task\_detailslog\_rolling.layout.type = OpenSearchJsonLayout  
appender.task\_detailslog\_rolling.layout.type\_name = task\_detailslog  
appender.task\_detailslog\_rolling.layout.opensearchmessagefields=taskId,type,action,description,start\_time\_millis,resource\_stats,metadata

appender.task\_detailslog\_rolling.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}\_task\_detailslog-%i.json.gz  
appender.task\_detailslog\_rolling.policies.type = Policies  
appender.task\_detailslog\_rolling.policies.size.type = SizeBasedTriggeringPolicy  
appender.task\_detailslog\_rolling.policies.size.size = 1GB  
appender.task\_detailslog\_rolling.strategy.type = DefaultRolloverStrategy  
appender.task\_detailslog\_rolling.strategy.max = 4  
#################################################  
######## Task details log - old style pattern ####  
appender.task\_detailslog\_rolling\_old.type = RollingFile  
appender.task\_detailslog\_rolling\_old.name = task\_detailslog\_rolling\_old  
appender.task\_detailslog\_rolling\_old.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}\_task\_detailslog.log  
appender.task\_detailslog\_rolling\_old.filePermissions = rw-r-----  
appender.task\_detailslog\_rolling\_old.layout.type = PatternLayout  
appender.task\_detailslog\_rolling\_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node\_name]%marker %m%n

appender.task\_detailslog\_rolling\_old.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}\_task\_detailslog-%i.log.gz  
appender.task\_detailslog\_rolling\_old.policies.type = Policies  
appender.task\_detailslog\_rolling\_old.policies.size.type = SizeBasedTriggeringPolicy  
appender.task\_detailslog\_rolling\_old.policies.size.size = 1GB  
appender.task\_detailslog\_rolling\_old.strategy.type = DefaultRolloverStrategy  
appender.task\_detailslog\_rolling\_old.strategy.max = 4  
#################################################  
logger.task\_detailslog\_rolling.name = task.detailslog  
logger.task\_detailslog\_rolling.level = trace  
logger.task\_detailslog\_rolling.appenderRef.task\_detailslog\_rolling.ref = task\_detailslog\_rolling  
logger.task\_detailslog\_rolling.appenderRef.task\_detailslog\_rolling\_old.ref = task\_detailslog\_rolling\_old  
logger.task\_detailslog\_rolling.additivity = false

################# Audit log #####################  
appender.audit\_rolling.type = RollingFile  
appender.audit\_rolling.name = audit\_rolling  
appender.audit\_rolling.fileName = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}\_audit.json  
appender.audit\_rolling.layout.type = OPENSEARCHJsonLayout  
appender.audit\_rolling.layout.type\_name = audit  
appender.audit\_rolling.layout.opensearchmessagefields=x-opaque-id

appender.audit\_rolling.filePattern = ${sys:opensearch.logs.base\_path}${sys:file.separator}${sys:opensearch.logs.cluster\_name}\_audit-%i.json.gz  
appender.audit\_rolling.policies.type = Policies  
appender.audit\_rolling.policies.size.type = SizeBasedTriggeringPolicy  
appender.audit\_rolling.policies.size.size = 1GB  
appender.audit\_rolling.strategy.type = DefaultRolloverStrategy  
appender.audit\_rolling.strategy.max = 4  
#################################################  
logger.audit\_rolling.name = audit  
logger.audit\_rolling.level = debug  
logger.audit\_rolling.appenderRef.audit\_rolling.ref = audit\_rolling  
logger.index\_indexing\_slowlog.additivity = false

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 26, 2024, 11:49pm UTC](https://forum.opensearch.org/t/log4j-audit-logs-console-filter/21648/2 "2024-09-26T23:49:17Z")

</div>

@mvrk Have you tried this option?

```auto
logger.audit_rolling.additivity = false

```

---

<div class="post-metadata">

**Author:** ![mvrk](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/mvrk/32/8176_2.png) [@mvrk](https://forum.opensearch.org/u/mvrk)\
**Post date:** [September 27, 2024, 8:13am UTC](https://forum.opensearch.org/t/log4j-audit-logs-console-filter/21648/3 "2024-09-27T08:13:40Z")

</div>

> [@pablo](#):
>
> `logger.audit_rolling.additivity = false`

Yup. it works, thank you.