Vault Operational Logs in JSON

Avatar
Mehdi Ahmadi
  • Updated

Vault Operational logs can be configured to output JSON event entries instead of the default string log format output.

There's one (1) of three (3) methods of configuring log format which are listed and exemplified below and in order of precedence:

  1. CLI Command option log-format like: vault server -config=vault.hcl -log-format=json

  2. Environment Variable VAULT_LOG_FORMAT like: export VAULT_LOG_FORMAT=json

  3. Vault (HCL) Parameter log_format in the configuration file like for example: log_format = "json"

Regardless of the configuration approach used any new setting or introduction and change in log format will require a restart to be applied and it may not be dynamically adjusted.

It's important to note that the emitted events can include other non-JSON entries including for example Vault process outputs or other type events (systemd, etc).

A complete sample output of Vault Operational Logs in JSON could resemble:

vault.service: Deactivated successfully.
Stopped vault.service - "HashiCorp Vault - A tool for managing secrets".
vault.service: Consumed 48.272s CPU time.
Started vault.service - "HashiCorp Vault - A tool for managing secrets".
WARNING: Request Limiter configuration is no longer supported; overriding server configuration to disable
WARNING! The following cipher suites defined by 'tls_cipher_suites' are
blacklisted by the HTTP/2 specification:
[TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_GCM_SHA256]
Please see https://tools.ietf.org/html/rfc7540#appendix-A for further information.
==> Vault server configuration:
Administrative Namespace:
             Api Address: https://10.10.1.232:8200
                     Cgo: enabled
         Cluster Address: https://10.10.1.232:8201
   Environment Variables: HOME, INVOCATION_ID, JOURNAL_STREAM, LANG, LOGNAME, PATH, SYSTEMD_EXEC_PID, USER, VAULT_ENABLE_SEAL_HA_BETA
              Go Version: go1.25.2
              Listener 1: tcp (addr: "127.0.0.1:8200", cluster address: "127.0.0.1:8201", disable_request_limiter: "false", max_json_array_element_count: "10000", max_json_depth: "300", max_json_object_entry_count: "10000", max_json_string_value_length: "1048576", max_request_duration: "1m30s", max_request_size: "33554432", tls: "disabled")
              Listener 2: tcp (addr: "10.10.1.178:8200", cluster address: "10.10.1.178:8201", disable_request_limiter: "false", max_json_array_element_count: "10000", max_json_depth: "300", max_json_object_entry_count: "10000", max_json_string_value_length: "1048576", max_request_duration: "1m30s", max_request_size: "33554432", tls: "disabled", x_forwarded_for_authorized_addrs: "[10.10.1.232]", x_forwarded_for_client_cert_header: "", x_forwarded_for_client_cert_header_decoders: "", x_forwarded_for_hop_skips: "0", x_forwarded_for_reject_not_authorized: "false", x_forwarded_for_reject_not_present: "false")
              Listener 3: tcp (addr: "10.10.1.232:8200", cluster address: "10.10.1.232:8201", disable_request_limiter: "false", max_json_array_element_count: "10000", max_json_depth: "300", max_json_object_entry_count: "10000", max_json_string_value_length: "1048576", max_request_duration: "1m30s", max_request_size: "33554432", tls: "enabled")
               Log Level: trace
                   Mlock: supported: true, enabled: false
           Recovery Mode: false
                 Storage: raft (HA available)
                 Version: Vault v1.21.0+ent.hsm, built 2025-10-22T02:52:40Z
             Version Sha: 2dae0c32ff0bcd2764e67ef0dc03cb75f1bbeb93
==> Vault server started! Log data will stream in below:
{"@level":"warn","@message":"unknown or unsupported field tls_prefer_server_cipher_suites found in configuration at /etc/vault.d/vault.hcl:24:2","@timestamp":"2025-12-08T15:35:27.609161Z"}
{"@level":"info","@message":"proxy environment","@timestamp":"2025-12-08T15:35:27.609181Z","http_proxy":"","https_proxy":"","no_proxy":""}
{"@level":"debug","@message":"time to open database","@module":"storage.raft.fsm","@timestamp":"2025-12-08T15:35:27.614130Z","elapsed":4868088,"path":"/vault/data/vault.db"}
{"@level":"debug","@message":"error checking if this node is removed. continuing under the assumption that it's not","@module":"storage.raft","@timestamp":"2025-12-08T15:35:27.631236Z","error":"not found"}
{"@level":"info","@message":"incrementing seal generation","@timestamp":"2025-12-08T15:35:27.631551Z","generation":1}

Resources

Articles in this section

See more