Publish keycloak logs in splunk

[zakariae Lebriq]

Hello folk, 

I'm using keycloak 17 with quarkus, It's been a while that I'm looking for how to push my local logs to splunk, I found out this beautiful doc https://quarkiverse.github.io/quarkiverse-docs/quarkus-logging-splunk/dev/index.html, However It's doesn't work nor when I add the dependency to my custom extension, not when I add the  jar  by copy  into the lib folder.

I want to ask of is there someone who has successfully sent the logs to splunk   with quarkus version 

Thank you guys

[Dominik Guhr]

Hi, can you try the following please?

1) download the runtime jar _and_ the deployment jar and place both in the providers directory. Jars available e.g. at [1][2]

2) create a quarkus.properties file in the `conf` folder and add your desired properties for splunk. 

3) apply a `build`

4) If the build succeeds,  start keycloak.should work (not tested here)

This should do the trick from what I see looking at the splung extension, but at the time of writing we know that this approach in general has some severe limitations, e.g. when the quarkus extension needs transient jars to work correctly you have to add them also (so maybe as of [3] your build would fail with a NoClassDefFoundException and you have to add the splunk-javalogging-library jar also to the providers dir). Another point is this is not applicable to extensions like e.g. quarkiverse-logging-json, as they would add already existing configuration options (in that case it's an "exclusive or" between the quarkiverse logging json and quarkus logging, both use the same config and you could just use one or the other, we use the quarkus one).

Having said that, this approach _should_ work but is experimental, so expect breaking changes to come in the future when we figured out how to apply extensions correctly from a multi-classpath application server to a flat-classpath framework ;)

Best regards,

Dominik

[1] https://repo1.maven.org/maven2/io/quarkiverse/logging/splunk/quarkus-logging-splunk-deployment/2.2.1/quarkus-logging-splunk-deployment-2.2.1.jar

[2] https://repo1.maven.org/maven2/io/quarkiverse/logging/splunk/quarkus-logging-splunk/2.2.1/quarkus-logging-splunk-2.2.1.jar

[3] https://github.com/quarkiverse/quarkus-logging-splunk/blob/main/pom.xml#L89-L93

--
You received this message because you are subscribed to the Google Groups "Keycloak User" group.
To unsubscribe from this group and stop receiving emails from it, send an email to keycloak-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/keycloak-user/68aff95e-d3a9-4d96-a507-8c2fe477da5bn%40googlegroups.com.

[zakariae Lebriq]

Hello Dominik,

I’d like to thank you for your response, I’ll dig this a little bit further and publish my result.

Regards 

--

Zakariae LEBRIQ

[zakariae Lebriq]

I've add the jar but I have this error during the build.

I'm still working on this riddle 

keycloak_1  | ERROR: Failed to run 'build' command.
keycloak_1  | ERROR: java.lang.RuntimeException: Failed to load steps from class io.quarkiverse.logging.splunk.LoggingSplunkProcessor
keycloak_1  | ERROR: Failed to load steps from class io.quarkiverse.logging.splunk.LoggingSplunkProcessor
keycloak_1  | ERROR: com/splunk/logging/HttpEventCollectorErrorHandler$ErrorCallback
keycloak_1  | ERROR: com.splunk.logging.HttpEventCollectorErrorHandler$ErrorCallback