What's are the fields and how do you set them in the Spring Cloud Sleuth log?

Question

My logs look like this

2022-05-05 17:08:11.686  WARN [,6274047bc8c37bf476c8bf6ff3052573,76c8bf6ff3052573] 1 --- [wtConsumer-8819] .a.ProtectedResourceGatewayFilterFactory : error obtaining claims:

What I am wondering ...

...[<WHAT IS THIS!!!!>,6274047bc8c37bf476c8bf6ff3052573,76c8bf6ff3052573] 1<-andThis --- <-andThis ...

And how to set them. Maybe put in the user name so we can track down the user more easily

Answer 1

This is the name of the application. You should set spring.application.name and that part will be filled out. Please read the docs here https://docs.spring.io/spring-cloud-sleuth/docs/current/reference/html/project-features.html#features-log-integration

For your convenience I'm pasting it here

Sleuth configures the logging context with variables including the service name (%{spring.zipkin.service.name} or %{spring.application.name} if the previous one was not set), span ID (%{spanId}) and the trace ID (%{traceId}). These help you connect logs with distributed traces and allow you choice in what tools you use to troubleshoot your services.

and a logstash pattern that describes each part of the log format

filter {
  # pattern matching logback pattern
  grok {
    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span}\]\s+%{DATA:pid}\s+---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:rest}" }
  }
  date {
    match => ["timestamp", "ISO8601"]
  }
  mutate {
    remove_field => ["timestamp"]
  }
}