We have a system deployed in the field that has Java services that use the logback logging framework. Each service has its own logback configuration file.
We’re finding a particular log message being issued at WARN level many times per second. We’re really only interested in seeing this message, for example, once/minute, so that we know the issue is occurring; but we don’t want to raise the logging level of the class, such that other messages at INFO level are discarded.
Modifying the code is not an option, nor is doing any modifications to the system that would involve restarting the offending service. However, we can modify the log configuration.
Is there any way in logback, through the XML configuration file, to achieve this behavior?
Update The messages are similar, but not identical; for example:
WARN The following ID will be dropped: 12345 WARN The following ID will be dropped: 54321
If the messages are exactly the same you might look at using the Duplicate Message filter.
Or you can use an evaluator filter expression: http://logback.qos.ch/manual/filters.html#evalutatorFilter
<filter class="ch.qos.logback.core.filter.EvaluatorFilter"> <evaluator name="loggingTaskEval"> <expression> message.contains("following ID will be dropped") && (timeStamp - event.getStartTime()) >= 20000 </expression> </evaluator> <OnMatch>DENY</OnMatch> </filter>
Found that example here: http://logback.qos.ch/demo.html