Update docs for Log4j 2

This commit updates the logging docs for Elasticsearch to reflect the
migration to Log4j 2.

docs/plugins/discovery-gce.asciidoc

@@ -271,19 +271,20 @@ If anything goes wrong, you should check logs:
 tail -f /var/log/elasticsearch/elasticsearch.log
 --------------------------------------------------
 
-If needed, you can change log level to `TRACE` by opening `logging.yml`:
+If needed, you can change log level to `trace` by opening `log4j2.properties`:
 
 [source,sh]
 --------------------------------------------------
-sudo vi /etc/elasticsearch/logging.yml
+sudo vi /etc/elasticsearch/log4j2.properties
 --------------------------------------------------
 
 and adding the following line:
 
 [source,yaml]
 --------------------------------------------------
 # discovery
-discovery.gce: TRACE
+logger.discovery_gce.name = discovery.gce
+logger.discovery_gce.level = trace
 --------------------------------------------------
 
 

docs/reference/index-modules/slowlog.asciidoc

@@ -40,17 +40,25 @@ of the actual execution on the specific machine, compared with request
 level.
 
 The logging file is configured by default using the following
-configuration (found in `logging.yml`):
+configuration (found in `log4j2.properties`):
 
 [source,yaml]
 --------------------------------------------------
-index_search_slow_log_file:
-  type: dailyRollingFile
-  file: ${path.logs}/${cluster.name}_index_search_slowlog.log
-  datePattern: "'.'yyyy-MM-dd"
-  layout:
-    type: pattern
-    conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"
+appender.index_search_slowlog_rolling.type = RollingFile
+appender.index_search_slowlog_rolling.name = index_search_slowlog_rolling
+appender.index_search_slowlog_rolling.fileName = ${sys:es.logs}_index_search_slowlog.log
+appender.index_search_slowlog_rolling.layout.type = PatternLayout
+appender.index_search_slowlog_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %.10000m%n
+appender.index_search_slowlog_rolling.filePattern = ${sys:es.logs}_index_search_slowlog-%d{yyyy-MM-dd}.log
+appender.index_search_slowlog_rolling.policies.type = Policies
+appender.index_search_slowlog_rolling.policies.time.type = TimeBasedTriggeringPolicy
+appender.index_search_slowlog_rolling.policies.time.interval = 1
+appender.index_search_slowlog_rolling.policies.time.modulate = true
+
+logger.index_search_slowlog_rolling.name = index.search.slowlog
+logger.index_search_slowlog_rolling.level = trace
+logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling.ref = index_search_slowlog_rolling
+logger.index_search_slowlog_rolling.additivity = false
 --------------------------------------------------
 
 [float]

docs/reference/migration/migrate_5_0/java.asciidoc

@@ -67,12 +67,13 @@ client.prepareSearch(indices).suggest(new SuggestBuilder().addSuggestion("foo",
 
 ==== Elasticsearch will no longer detect logging implementations
 
-Elasticsearch now logs only to log4j 1.2. Previously if log4j wasn't on the
-classpath it made some effort to degrade to slf4j or java.util.logging. Now it
-will fail to work without the log4j 1.2 api. The log4j-over-slf4j bridge ought
-to work when using the java client, as should log4j 2's log4j-1.2-api. The
-Elasticsearch server now only supports log4j as configured by `logging.yml`
-and will fail if log4j isn't present.
+Elasticsearch now logs using Log4j 2. Previously if Log4j wasn't on the
+classpath it made some effort to degrade to SLF4J or Java logging. Now it will
+fail to work without the Log4j 2 API. The log4j-over-slf4j bridge ought to work
+when using the Java client. The log4j-1.2-api bridge is used for third-party
+dependencies that still use the Log4j 1 API. The Elasticsearch server now only
+supports Log4j 2 as configured by `log4j2.properties` and will fail if Log4j
+isn't present.
 
 ==== Groovy dependencies
 

docs/reference/setup/configuration.asciidoc

@@ -15,7 +15,7 @@ able to join a cluster, such as `cluster.name` and `network.host`.
 Elasticsearch has two configuration files:
 
 * `elasticsearch.yml` for configuring Elasticsearch, and
-* `logging.yml` for configuring Elasticsearch logging.
+* `log4j2.properties` for configuring Elasticsearch logging.
 
 These files are located in the config directory, whose location defaults to
 `$ES_HOME/config/`.  The Debian and RPM packages set the config directory
@@ -110,27 +110,53 @@ command line with `es.node.name` or in the config file with `node.name`.
 [[logging]]
 == Logging configuration
 
-Elasticsearch uses an internal logging abstraction and comes, out of the
-box, with http://logging.apache.org/log4j/1.2/[log4j]. It tries to simplify
-log4j configuration by using http://www.yaml.org/[YAML] to configure it,
-and the logging configuration file is `config/logging.yml`. The
-http://en.wikipedia.org/wiki/JSON[JSON] and
-http://en.wikipedia.org/wiki/.properties[properties] formats are also
-supported. Multiple configuration files can be loaded, in which case they will
-get merged, as long as they start with the `logging.` prefix and end with one
-of the supported suffixes (either `.yml`, `.yaml`, `.json` or `.properties`).
-The logger section contains the java packages and their corresponding log
-level, where it is possible to omit the `org.elasticsearch` prefix. The
-appender section contains the destinations for the logs. Extensive information
-on how to customize logging and all the supported appenders can be found on
-the http://logging.apache.org/log4j/1.2/manual.html[log4j documentation].
+Elasticsearch uses http://logging.apache.org/log4j/2.x/[Log4j 2] for
+logging. Log4j 2 can be configured using the log4j2.properties
+file. Elasticsearch exposes a single property `${sys:es.logs}` that can be
+referenced in the configuration file to determine the location of the log files;
+this will resolve to a prefix for the Elasticsearch log file at runtime.
+
+For example, if your log directory (`path.logs`) is `/var/log/elasticsearch` and
+your cluster is named `production` then `${sys:es.logs}` will resolve to
+`/var/log/elasticsearch/production`.
 
-Additional Appenders and other logging classes provided by
-http://logging.apache.org/log4j/extras/[log4j-extras] are also available,
-out of the box.
+[source,properties]
+--------------------------------------------------
+appender.rolling.type = RollingFile <1>
+appender.rolling.name = rolling
+appender.rolling.fileName = ${sys:es.logs}.log <2>
+appender.rolling.layout.type = PatternLayout
+appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %.10000m%n
+appender.rolling.filePattern = ${sys:es.logs}-%d{yyyy-MM-dd}.log <3>
+appender.rolling.policies.type = Policies
+appender.rolling.policies.time.type = TimeBasedTriggeringPolicy <4>
+appender.rolling.policies.time.interval = 1 <5>
+appender.rolling.policies.time.modulate = true <6>
+--------------------------------------------------
+
+<1> Configure the `RollingFile` appender
+<2> Log to `/var/log/elasticsearch/production.log`
+<3> Roll logs to `/var/log/elasticsearch/production-yyyy-MM-dd.log`
+<4> Using a time-based roll policy
+<5> Roll logs on a daily basis
+<6> Align rolls on the day boundary (as opposed to rolling every twenty-four
+    hours)
+
+If you append `.gz` or `.zip` to `appender.rolling.filePattern`, then the logs
+will be compressed as they are rolled.
+
+Multiple configuration files can be loaded (in which case they will get merged)
+as long as they are named `log4j2.properties` and have the Elasticsearch config
+directory as an ancestor; this is useful for plugins that expose additional
+loggers.  The logger section contains the java packages and their corresponding
+log level, where it is possible to omit the `org.elasticsearch` prefix. The
+appender section contains the destinations for the logs. Extensive information
+on how to customize logging and all the supported appenders can be found on the
+http://logging.apache.org/log4j/2.x/manual/configuration.html[Log4j
+documentation].
 
 [float]
-[[deprecation-logging]]e
+[[deprecation-logging]]
 === Deprecation logging
 
 In addition to regular logging, Elasticsearch allows you to enable logging
@@ -139,14 +165,14 @@ you need to migrate certain functionality in the future. By default,
 deprecation logging is enabled at the WARN level, the level at which all
 deprecation log messages will be emitted.
 
-[source,yaml]
+[source,properties]
 --------------------------------------------------
-deprecation: WARN, deprecation_log_file
+logger.deprecation.level = warn
 --------------------------------------------------
 
 This will create a daily rolling deprecation log file in your log directory.
 Check this file regularly, especially when you intend to upgrade to a new
 major version.
 
-You can disable it in the `config/logging.yml` file by setting the deprecation
-log level to `INFO`.
+You can disable it in the `config/log4j2.properties` file by setting the deprecation
+log level to `info`.

docs/reference/setup/install/sysconfig-file.asciidoc

@@ -40,7 +40,7 @@
 `CONF_DIR`::
 
     Configuration file directory (which needs to include `elasticsearch.yml`
-    and `logging.yml` files), defaults to `/etc/elasticsearch`.
+    and `log4j2.properties` files), defaults to `/etc/elasticsearch`.
 
 `ES_JAVA_OPTS`::
 

docs/reference/setup/install/windows.asciidoc

@@ -156,7 +156,7 @@ The Elasticsearch service can be configured prior to installation by setting the
 `CONF_DIR`::
 
     Configuration file directory (which needs to include `elasticsearch.yml`
-    and `logging.yml` files), defaults to `%ES_HOME%\conf`.
+    and `log4j2.properties` files), defaults to `%ES_HOME%\conf`.
 
 `ES_JAVA_OPTS`::