We are currently not able to monitor our Pega logs files correctly in ELK and need to create a separate logger in JSON format that be consumed correctly. I believe the steps below would need to be followed but would be grateful for a confirmation if anyone else done similar:

Pega uses Log4j2 with plain-text pattern layouts, though it does support natively logging through JSON layout.

1. We need to locate the prlog4j2.jar and extract log4j2.xml
2. Create a custom appender that uses JSON layout e.g.:
   <Appender>
     <File name="JsonFile" fileName="logs/pega-json.log" append="true">
         <JsonLayout compact="true" eventEol="true" />
     </File>
   </Appender>
3. Attach it to the root logger e.g.:
   <Loggers>
      <Logger name="com.pega" level="Info" additivity="false">
         <AppenderRef="JsonFile"/>
      </Loggers>
   </Loggers>

Note: Pega upgrades will overwrite the log4j2.