Oh right, JTL isn’t in core, but it could be!

And if we change the default layout to continue using a pattern layout, how 
about some colors and such like how Spring Boot defaults?

And yes, multiple default configurations was another idea I had, but I wasn’t 
sure how to phrase that.

> On Oct 3, 2023, at 11:57 AM, Ralph Goers <ralph.go...@dslextreme.com> wrote:
> 
> Are you just talking about changing the current default configuration? Or are 
> you envisioning having more than one somewhow? 
> 
> If this is just about changing the current default configuration then I have 
> some concerns:
> 1. It always has to work. 
> 2. It cannot rely on optional components. JsonTemplateLayout is not in core 
> so it cannot be included in the default. However, we could detect if it is 
> available and use it if it is.
> 
> Changing from PatternLayout to JsonTemplateLayout that only makes sense if 
> you have tools to interpret the JSON. Looking at the raw JSON is painful. 
> I’ve done it.
> 
> Finally, my hope is that no one is using the default configuration. I can’t 
> really think of any application that should be using it. However, we could 
> create multiple defaults tailored to specific application types.
> 
> Ralph
> 
>> On Oct 3, 2023, at 9:35 AM, Matt Sicker <m...@musigma.org> wrote:
>> 
>> I’ve had this idea for many years now, and as we get closer to 3.0, it seems 
>> like it’s time to consider the details. We can change the default 
>> configuration in 3.0 without being as surprising as any other version. I 
>> think we could use this as an opportunity to demonstrate some best practices 
>> and recommendations. For example, we could switch from PatternLayout to 
>> JsonTemplateLayout by default to help prevent common vulnerabilities related 
>> to log message forging (like putting a newline or similar and faking the log 
>> output in the following line). Then there’s an option related to direct 
>> console writing that we have disabled by default despite being benign. There 
>> are probably other settings I haven’t considered at the moment.
>> 
>> So what do you think? Any suggestions for the default configuration?
> 

Reply via email to