[float]
[[breaking_70_logging_changes]]
=== Logging changes

//NOTE: The notable-breaking-changes tagged regions are re-used in the
//Installation and Upgrade Guide

//tag::notable-breaking-changes[]

// end::notable-breaking-changes[]

[float]
[[new-json-format-log-directory]]
==== New JSON format log files in `log` directory

Elasticsearch now will produce additional log files in JSON format. They will be stored in `*.json` suffix files.
Following files should be expected now in log directory:
* ${cluster_name}_server.json
* ${cluster_name}_deprecation.json
* ${cluster_name}_index_search_slowlog.json
* ${cluster_name}_index_indexing_slowlog.json
* ${cluster_name}.log
* ${cluster_name}_deprecation.log
* ${cluster_name}_index_search_slowlog.log
* ${cluster_name}_index_indexing_slowlog.log
* ${cluster_name}_audit.json
* gc.log

Note: You can configure which of these files are written by editing `log4j2.properties`.

[float]
[[log-files-ending-log-deprecated]]
==== Log files ending with `*.log` deprecated
Log files with the `.log` file extension using the old pattern layout format
are now considered deprecated and the newly added JSON log file format with
the `.json` file extension should be used instead.
Note: GC logs which are written to the file `gc.log` will not be changed.

[float]
==== Docker output in JSON format

All Docker console logs are now in JSON format. You can distinguish logs streams with the `type` field.

[float]
==== Audit plaintext log file removed, JSON file renamed

Elasticsearch no longer produces the `${cluster_name}_access.log` plaintext
audit log file. The `${cluster_name}_audit.log` files also no longer exist; they
are replaced by `${cluster_name}_audit.json` files. When auditing is enabled,
auditing events are stored in these dedicated JSON log files on each node.