How to send Mule application logging entries to Elasticsearch or the ELK Stack using the Socket Appender

1. Add the Socket appender entry to log4j. For example:

   <Socket name="socket" host="${sys:elk.host}" port="${sys:elk.port}" protocol="TCP">
     <PatternLayout pattern="{&quot;log_timestamp&quot;:&quot;%d&quot; ,&quot;log_thread&quot;:&quot;[%t]&quot; , &quot;log_level&quot;:&quot;%-5p&quot; , %m}%n" /> 
   </Socket>

   Note: "elk.host" and "elk.port" are the Elasticsearch server host and port to send the logging entries to. In the above example, you will need to pass the values as system properties. 

2. Add SSL information when needed.  If the remote server is secured by TLS, please provide SSL configuration. The following example shows a 2-way SSL configuration where both truststore and keystore are configured:

   <Socket name="socket" host="${sys:elk.host}" port="${sys:elk.port}" protocol="TCP">
     <PatternLayout pattern="{&quot;log_timestamp&quot;:&quot;%d&quot; ,&quot;log_thread&quot;:&quot;[%t]&quot; , &quot;log_level&quot;:&quot;%-5p&quot; , %m}%n" /> 
     <SSL> 
       <KeyStore location="${sys:path}/elk.jks" password="changeit"/> 
       <TrustStore location="${sys:path}/elk.jks" password="changeit"/> 
     </SSL>
   </Socket>

3. Configure the Mule application to log to the Socket appended within the log4j2.xml. For example:

<AsyncRoot level="INFO">
  <AppenderRef ref="FILE" />
  <AppenderRef ref="socket" />
</AsyncRoot>