anchor.diff:  ----
   
   Finally, the logstash configuration.
  -It is quite simple, however access log events tend to have field names, that are incompatible with recent versions of elasticsearch, therefore they need to be adapted a bit:
  +
  +It is quite a simple configuration, however access log events tend to have field names that are incompatible with recent versions of elasticsearch. To work around this problem, they need to be adapted a bit, as shown in the filter below:
   
   [source,ruby]
   ----
  
positive.code: == Adapt your application
  
  Your application also needs small tuning now to prevent various class incompatibility errors.
  Both slf4j-api, and logback-classic should now be a _provided_ dependencies of your application. 
  In other words, there should not be included in your _.war_ or _.ear_ build.
  
  == Downsides
  
  `asadmin set-log-levels` no longer works, as logback is the one filtering the levels and you need different way of controlling log levels.
  
  == Give feedback
  
  Let us know how this setup works for you.
  You're also invited to share your projects' https://github.com/goodees/goodees[goodees]!
  
negative.code:     </root>
  </configuration>
  ----
  The following points should be noted:
  
  <1> Propagation between `slf4j and `java.util.logging` is needed
  <2> We put the logging directory outside of the domain directory, and controlled by an environment variable. `instanceName` is a JVM argument, that is unique for every instance in our system.
  <3> We keep the JSON formatted logs on disk with greater retention period than our Elasticsearch does. If we need to, we can re-upload those to analyze past events.
  <4> Mutliple destinations in form of `host:port[,host:port]` can be defined for the Logstash socket appender. We keep then in an environment variable.
  
  We have similar configuration for `logback-access.xml`:
  
  [source,xml]
  ----
  