Requesting a Splunk-specific layout-class for log4j2

By default -- without any layout specified -- the SplunkHttp-appender will simply log the textual message itself, along with a few other standard fields.

To get more details -- and even, optionally, insert additional custom fields -- one would use the JsonLayout. For example:

		<SplunkHttp name="SplunkDetailed"
		    url="https://splunk-hec-app1:8088"
		    index="idx"
		    host="${hostname}"
		    sourcetype="log4j2"
		    source="QA:${nickname}:${alias}"
		    batch_size_count="17"
		    batch_interval="3"
		    disableCertificateValidation="true"
		    token="7d8xxx25b">
			<JsonLayout
			    compact="true"
			    eventEol="true"
			    propertiesAsList="true"
			    includeStacktrace="true"
			    locationInfo="true"
			    objectMessageAsJsonObject="true"/>
				<KeyValuePair key="applicationInstance" value="QA"/>
			</JsonLayout>
		</SplunkHttp>

This works Ok, but results in useless duplications... For example, here is one event logged using above configuration:

{
  "severity": "WARN",
  "logger": "our.deeply.buried.class.MessageHandler",
  "time": "1632494387.518",
  "thread": "pool-15-thread-2",
  "message": {
    "thread": "pool-15-thread-2",
    "level": "WARN",
    "loggerName": "our.deeply.buried.class.MessageHandler",
    "message": "Our verbose message",
    "endOfBatch": false,
    "loggerFqcn": "org.slf4j.impl.Log4jLoggerAdapter",
    "instant": {
      "epochSecond": 1632494387,
      "nanoOfSecond": 518362000
    },
    "applicationInstance": "QA",
    "contextMap": [],
    "threadId": 154,
    "threadPriority": 5,
    "source": {
      "class": "our.deeply.buried.class.MessageHandler",
      "method": "createImportPreconditionsMessage",
      "file": "MessageHandler.java",
      "line": 91
    }
  }
}

As you can see, there are problems:

1. message.level is the same thing as severity.
2. message.thread is a copy of thread.
3. logger is a copy of message.loggerName.
4. message.instant duplicates time.
5. endOfBatch is quite useless, but cannot be suppressed.
6. message.contextMap is always included even when empty.
7. The useful additional information is all "hidden" in the message dictionary -- including the actual message.message text. It'd be nicer, if the fields were at the top level: threadPriority instead of message.threadPriority.

One cannot blame the stock JsonLayout class for this redundancy, because it does not know, that the calling appender (SplunkHttp) is adding the information too. One's only way to make the events appear more sensible, currently, is to implement special manipulations on the Splunk-server side, based on the sourceType.

Hence a request for a custom SplunkLayout to format the messages as would make sense for Splunk in particular.

Start by reviewing the SplunkHttp appender and the stock JsonLayout configuration described in the issue. Define the SplunkLayout output around the listed redundancies: avoid duplicated fields, omit unwanted empty or fixed fields, and expose useful message fields at the top level. Done means Splunk events have the requested non-redundant structure.