From bf4d738ba9a4c5dcfecf75e70493bf2cac55f426 Mon Sep 17 00:00:00 2001
From: gonedays <luzuoqi@163.com>
Date: Sun, 8 Dec 2019 21:59:20 +0800
Subject: [PATCH] Add instructions for logback with logstash in custom json
 format (#4019)

Add instructions for logback configuration with logstash, use custom
json format
---
 .../Application-toolkit-logback-1.x.md        | 33 ++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/docs/en/setup/service-agent/java-agent/Application-toolkit-logback-1.x.md b/docs/en/setup/service-agent/java-agent/Application-toolkit-logback-1.x.md
index ea4c8304c..1e1493bc7 100644
--- a/docs/en/setup/service-agent/java-agent/Application-toolkit-logback-1.x.md
+++ b/docs/en/setup/service-agent/java-agent/Application-toolkit-logback-1.x.md
@@ -76,4 +76,35 @@
     <provider class="org.apache.skywalking.apm.toolkit.log.logback.v1.x.logstash.TraceIdJsonProvider">
     </provider>
 </encoder>
-```
\ No newline at end of file
+```
+
+* set `LoggingEventCompositeJsonEncoder` of logstash in logback-spring.xml for custom json format
+
+1.add converter for %tid as child of <configuration> node
+```xml
+<!--add converter for %tid -->
+    <conversionRule conversionWord="tid" converterClass="org.apache.skywalking.apm.toolkit.log.logback.v1.x.LogbackPatternConverter"/>
+```
+2.add json encoder for custom json format
+
+```xml
+<encoder class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
+            <providers>
+                <timestamp>
+                    <timeZone>UTC</timeZone>
+                </timestamp>
+                <pattern>
+                    <pattern>
+                        {
+                        "level": "%level",
+                        "tid": "%tid",
+                        "thread": "%thread",
+                        "class": "%logger{1.}:%L",
+                        "message": "%message",
+                        "stackTrace": "%exception{10}"
+                        }
+                    </pattern>
+                </pattern>
+            </providers>
+</encoder>
+```