We are currently not able to monitor our Pega logs files correctly in ELK and need to create a separate logger in JSON format that be consumed correctly. I believe the steps below would need to be followed but would be grateful for a confirmation if anyone else done similar:

Pega uses Log4j2 with plain-text pattern layouts, though it does support natively logging through JSON layout.

1. We need to locate the prlog4j2.jar and extract log4j2.xml
2. Create a custom appender that uses JSON layout e.g.: <Appender>   <File name="JsonFile" fileName="logs/pega-json.log" append="true">       <JsonLayout compact="true" eventEol="true" />   </File> </Appender>
3. Attach it to the root logger e.g.: <Loggers>    <Logger name="com.pega" level="Info" additivity="false">       <AppenderRef="JsonFile"/>    </Loggers> </Loggers>

Note: Pega upgrades will overwrite the log4j2.