Is is possible to log in JSON format in AEM 6.5

[SmrithiGo]

Hi,

We have a business requirement to log in JOSN format.

we have integrated with Elastic APM, and also configured fleet to view error.log and custom logs, but log format in error.log logs don't really match the Elastic Common Schema, hence we are trying to generate logs in JSON format.

As anyone used this JSON Event Logger for the above requirement.

Thanks

[SantoshSai]

Hi @SmrithiGo,

Yes, JSON logging is possible in AEM 6.5. Since AEM uses Logback underneath the Sling logger API, you can enable JSON logging by adding a custom Logback configuration and encoder through your codebase. Below are the steps:

Add Logstash Logback Encoder library to your project

(This enables JSON output)

pom.xml

<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>7.3</version>
</dependency>

Deploy this via your AEM project bundle package.

Create / override Logback config

Add file in:

/crx-quickstart/conf/logback.xml

Example JSON logger config:

<configuration>

    <appender name="JSON_LOG" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>logs/aem-json.log</file>
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>logs/aem-json-%d{yyyy-MM-dd}.log</fileNamePattern>
            <maxHistory>7</maxHistory>
        </rollingPolicy>

        <encoder class="net.logstash.logback.encoder.LoggingEventEncoder">
            <provider class="net.logstash.logback.composite.loggingevent.LoggingEventPatternJsonProvider">
                <pattern>
                    {"timestamp":"%d{yyyy-MM-dd'T'HH:mm:ss.SSSZ}", "level":"%level", "logger":"%logger", "message":"%msg"}
                </pattern>
            </provider>
        </encoder>
    </appender>

    <logger name="com.mycompany" level="INFO" additivity="false">
        <appender-ref ref="JSON_LOG"/>
    </logger>

</configuration>

This generates structured JSON logs that Elastic can map to ECS fields.

Logging from code remains unchanged

Use the standard SLF4J API:

private static final Logger log = LoggerFactory.getLogger(MyService.class);
log.info("Customer onboarding started");

JSON formatting will be applied automatically

Deploy & restart AEM

JSON logs will show up under:

crx-quickstart/logs/aem-json.log

[SmrithiGo]

thanks for the response @SantoshSai .

I will try this out and let you know. Could you please let me know where this file 

/crx-quickstart/conf/logback.xml 

will be located in the maven project. Thank you. 

[SantoshSai]

@SmrithiGo 

The logback.xml file does not naturally exist inside the AEM Maven project structure by default.
Instead, it needs to be packaged from your codebase and deployed into AEM under:

/crx-quickstart/conf/logback.xml

Include it in your Maven project

Create the file under your ui.apps module (or a dedicated config module):

ui.apps/src/main/content/jcr_root/apps/<your-project>/config/logback.xml

Then ensure it gets installed under the correct AEM internal path using the filter rule:

<filter root="/crx-quickstart/conf" mode="merge"/>

So when your package deploys, it overlays to:

/crx-quickstart/conf/logback.xml

[SmrithiGo]

HI @SantoshSai ,

should i create this log file 

logs/aem-json.log

in Apache Sling Logging Logger Configuration, because, I placed logback.xml file directly under crx-quickstart folder

and after restart I dont see the logs in json format.

[SantoshSai]

No - don’t create it manually or via Sling Logger.
If your logback.xml is valid and placed directly under

<your AEM root>/crx-quickstart/conf/logback.xml

AEM will auto-create logs/aem-json.log on startup.

If you don’t see JSON logs, check that:

• You fully restarted AEM (not just bundles).

• The encoder JAR (logstash-logback-encoder) is deployed.

• The XML is valid - otherwise AEM falls back to default logging.

[ManviSharma]

Hi @SmrithiGo,

Yes, this is definitely possible in AEM 6.5. Since AEM uses Logback internally, you can easily output logs in JSON format by adding a JSON encoder and defining a custom appender.

Here’s the simplest way to achieve it:

1. Add the dependency
Include the Logstash Logback Encoder in your project’s pom.xml:

<dependency>

  <groupId>net.logstash.logback</groupId>

  <artifactId>logstash-logback-encoder</artifactId>

  <version>7.3</version>

</dependency>

2. Create a JSON log appender
   In /crx-quickstart/conf/logback.xml, add:

<appender name="JSON" class="ch.qos.logback.core.FileAppender">

  <file>${crx.home}/logs/aem-json.log</file>

  <encoder class="net.logstash.logback.encoder.LogstashEncoder" />

</appender>

<logger name="com.mycompany" level="INFO" additivity="false">

  <appender-ref ref="JSON" />

</logger>

3. Deploy & restart AEM
   Logs for your package will now be written in JSON format under /crx-quickstart/logs/aem-json.log.
4. Connect with Elastic Agent
   Point your Elastic Agent/Fleet configuration to read this file as JSON. The structured output will map cleanly to ECS fields and can be correlated with Elastic APM.

This is the most lightweight and clean approach — no core AEM changes, only one encoder dependency and one config file update.

Hope this helps.

Regards,
Manvi Sharma

[SmrithiGo]

thanks @ManviSharma for the detailed steps.