In Java, using the logback framework, is there a way to dynamically configure throttling for a chatty log message

We have a system deployed in the field that has Java services that use the logback logging framework. Each service has its own logback configuration file.

We’re finding a particular log message being issued at WARN level many times per second. We’re really only interested in seeing this message, for example, once/minute, so that we know the issue is occurring; but we don’t want to raise the logging level of the class, such that other messages at INFO level are discarded.

Modifying the code is not an option, nor is doing any modifications to the system that would involve restarting the offending service. However, we can modify the log configuration.

Is there any way in logback, through the XML configuration file, to achieve this behavior?

Update The messages are similar, but not identical; for example:

WARN The following ID will be dropped: 12345
WARN The following ID will be dropped: 54321

Answer

If the messages are exactly the same you might look at using the Duplicate Message filter.

http://logback.qos.ch/manual/filters.html#DuplicateMessageFilter

Or you can use an evaluator filter expression: http://logback.qos.ch/manual/filters.html#evalutatorFilter

Like so

<filter class="ch.qos.logback.core.filter.EvaluatorFilter">
  <evaluator name="loggingTaskEval">
    <expression>
      message.contains("following ID will be dropped") &amp;&amp;
      (timeStamp - event.getStartTime()) >= 20000
    </expression>
  </evaluator>
  <OnMatch>DENY</OnMatch>
</filter>

Found that example here: http://logback.qos.ch/demo.html