updated docs

Damien Dallimore · Damien Dallimore · commit 995c77269a03 · 2014-02-10T18:48:42.000+13:00
diff --git a/README.md b/README.md
@@ -1,12 +1,13 @@
 # Splunk Java Logging Framework
 
 The purpose of this project is to create a logging framework to allow developers to as seamlessly as possible
-integrate Splunk best practice logging semantics into their code.
-There are also custom handler/appender implementations for the 3 most prevalent Java logging frameworks in play.
+integrate Splunk best practice logging semantics into their code and easily send their log events to Splunk.
+There are also custom handler/appender implementations and config examples for the most prevalent Java logging frameworks in play.
 
 1.	LogBack
-2.	Log4j
-3.	java.util logging
+2.	Log4j 1.x
+3.  Log4j 2
+4.	java.util logging
 
 This framework contains :
 
@@ -20,9 +21,21 @@ This framework contains :
 *   Example logging configuration files
 *   Javadocs
 
-If you want to use UDP to send events to Splunk , then Log4j and Logback  already have Syslog Appenders.
+If you want to use UDP to send events to Splunk , then Log4j 1.x and Logback  already have Syslog Appenders.
+Log4j 2 has a UDP Appender and Syslog Appender.
 And of course you can still use any File appenders and have the file monitored by a Splunk Universal Forwarder.
 
+I generally recommend using the raw TCP handlers/appenders I have provided , they perform the best, and have features coded into them for 
+auto connection re-establishment and configurable buffering of log events which will get flushed upon reconnection.
+
+## Logging frameworks galore
+
+Log4j 2 and Log4j 1.x are very distinct from one another.
+Logback was actually the "new version" of Log4j 1.x , and then Log4J 2 attempted to improve upon Logback.
+This rather convoluted family tree has essentially transpired with 3 different logging frameworks in play, each with different characteristics.
+Log4j 1.x still has a very large legacy usage base in enterprise software therefore warrants addressing with its own custom appenders 
+and example configurations.
+
 ## Splunk Universal Forwarder vs Splunk Java Logging
 
 I always advocate the best practice of using a Splunk Universal Forwarder(UF) monitoring local files wherever possible.
@@ -32,9 +45,6 @@ be deployed.In this case, Splunk Java Logging can be used to forward events to S
 Furthermore, in either scenario, you can still utilize the SplunkLogEvent class to construct your log events in best practice 
 semantic format.
 
-#Log4J2
-
-I have included a sample configuration file for sending events to Splunk over raw TCP and UDP
 
 ## Resilience
 
@@ -59,6 +69,11 @@ as a load balancing intermediary before you Indexer Cluster.
 ## Failover
 
 Log4J 2 has a Failover appender you can use : http://logging.apache.org/log4j/2.x/manual/appenders.html#FailoverAppender
+There is an example in config/log4j2.xml
+
+## Routing
+
+Log4J 2 has a Routing appender you can use : http://logging.apache.org/log4j/2.x/manual/appenders.html#RoutingAppender
 
 ## Thread Safety
 
diff --git a/config/log4j2.xml b/config/log4j2.xml
@@ -1,24 +1,33 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
-<!--Example log4j2 configuration using a Splunk Raw TCP and UDP Appender-->
+<!--Example log4j2 configuration using a Splunk Raw TCP and UDP Appender -->
 
 
 <Configuration status="info" name="MySplunkApp" packages="">
 
 	<Appenders>
 
-		<Socket name="splunkrawtcp" protocol="TCP" host="ubuntu-splunk" port="5151">
+		<Socket name="splunkrawtcp" protocol="TCP" host="ubuntu-splunk"
+			port="5151">
 			<PatternLayout pattern="%m%n" />
 		</Socket>
-		
-		<Socket name="splunkrawudp" protocol="UDP" host="ubuntu-splunk" port="5152">
+
+		<Socket name="splunkrawudp" protocol="UDP" host="ubuntu-splunk"
+			port="5152">
 			<PatternLayout pattern="%m%n" />
 		</Socket>
 
 
 		<Console name="stdout" target="SYSTEM_OUT">
 			<PatternLayout pattern="%m%n" />
 		</Console>
+
+		<Failover name="failover_example" primary="splunkrawtcp">
+			<Failovers>
+				<AppenderRef ref="stdout" />
+			</Failovers>
+		</Failover>
+
 	</Appenders>
 
 	<Loggers>
@@ -27,7 +36,8 @@
 		</Root>
 		<logger name="splunk.logger" additivity="false" level="INFO">
 			<appender-ref ref="splunkrawtcp" />
-			<appender-ref ref="splunkrawudp" />
+			<!-- <appender-ref ref="splunkrawudp" /> -->
+			<!-- <appender-ref ref="failover_example" /> -->
 		</logger>
 	</Loggers>
 
diff --git a/releases/splunklogging-1.0.tar.gz b/releases/splunklogging-1.0.tar.gz
