[OTel] Introduce preview support for OpenTelemetry Logs (#41265)

Closes #41264

Co-authored-by: Ryan Emerson <remerson@redhat.com

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

common/src/main/java/org/keycloak/common/Profile.java

@@ -130,6 +130,7 @@ public class Profile {
         OID4VC_VCI("Support for the OID4VCI protocol as part of OID4VC.", Type.EXPERIMENTAL),
 
         OPENTELEMETRY("OpenTelemetry support", Type.DEFAULT),
+        OPENTELEMETRY_LOGS("OpenTelemetry Logs support", Type.PREVIEW, OPENTELEMETRY),
 
         DECLARATIVE_UI("declarative ui spi", Type.EXPERIMENTAL),
 

docs/documentation/release_notes/topics/26_5_0.adoc

@@ -144,7 +144,7 @@ For more details, see the https://www.keycloak.org/server/logging#_adding_contex
 
 == New centralized telemetry options
 
-{project_name} now provides centralized telemetry configuration options that can be shared across all telemetry (OpenTelemetry) components - traces, with future support planned for logs and metrics.
+{project_name} now provides centralized telemetry configuration options that can be shared across all telemetry (OpenTelemetry) components - traces and logs, with future support planned for metrics.
 Individual components can override these global settings when needed.
 
 New options: `telemetry-endpoint`, `telemetry-protocol`, `telemetry-service-name`, and `telemetry-resource-attributes`.
@@ -152,3 +152,10 @@ New options: `telemetry-endpoint`, `telemetry-protocol`, `telemetry-service-name
 *Deprecation:* The `tracing-service-name` and `tracing-resource-attributes` options are now deprecated in favor of `telemetry-service-name` and `telemetry-resource-attributes`.
 
 For more details, see the link:{telemetryguide_link}[{telemetryguide_name}] guide.
+
+== OpenTelemetry Logs (preview)
+
+{project_name} now supports exporting logs to OpenTelemetry collectors, enabling centralized log management.
+This preview feature allows you to export {project_name} logs to any OpenTelemetry-compatible backend and use the same OpenTelemetry collector for logs and traces.
+
+For more details, see the link:{telemetryguide_link}[{telemetryguide_name}] guide.

docs/guides/observability/telemetry.adoc

@@ -2,6 +2,8 @@
 <#import "/templates/kc.adoc" as kc>
 <#import "/templates/options.adoc" as opts>
 <#import "/templates/links.adoc" as links>
+<#import "/templates/profile.adoc" as profile>
+<#import "/templates/features.adoc" as features>
 
 <@tmpl.guide
 title="Centralize your observability stack with OpenTelemetry"
@@ -55,11 +57,58 @@ See the https://www.keycloak.org/observability/tracing[Root cause analysis with
 
 You can override the global OpenTelemetry settings via the Tracing options if you want to export traces to a different OpenTelemetry collector.
 
-<@opts.printRelevantOptions includedOptions="telemetry-*">
+== Logs
+
+<@features.techpreview feature="opentelemetry-logs"/>
+
+NOTE: The OpenTelemetry feature (`opentelemetry`) needs to be turned on (by default).
+
+It is possible to export {project_name}'s logs to the OpenTelemetry collector and be managed by various logging backends that support OpenTelemetry.
+
+=== Enable Logs
+You can enable OpenTelemetry Logs via CLI as follows:
+
+<@kc.start parameters="--features=opentelemetry-logs --telemetry-logs-enabled=true"/>
+
+For more details about OpenTelemetry Logs functionality in Quarkus, see the https://quarkus.io/guides/opentelemetry-logging[Quarkus OpenTelemetry Logging guide].
+For more information on how to set up logging, see the https://www.keycloak.org/server/logging[Configuring Logging guide].
+
+=== Log level
+By default, all log levels are exported by {project_name}.
+You can optionally configure the most verbose log level to be exported via the `telemetry-logs-level` option.
+
+For example, if you want only to export `WARN` and `ERROR` logs, you can change the log level via the CLI as follows:
+
+<@kc.start parameters="--telemetry-logs-level=WARN"/>
+
+<@profile.ifCommunity>
+
+== Development setup
+
+For development purposes, you can use the https://github.com/grafana/docker-otel-lgtm[Grafana OTel-LGTM service], containing OpenTelemetry Collector and backends for logs (Loki), metrics (Prometheus), and traces (Tempo).
+
+.Service architecture
+image::observability/grafana-otel-lgtm.png[]
+
+You can start the service by using Docker/Podman as follows:
+
+[source,shell]
+----
+docker run -p 3000:3000 -p 4317:4317 -p 4318:4318 --rm -ti grafana/otel-lgtm
+----
+
+Then, you can navigate to Grafana UI by accessing `+localhost:3000+` and then you can explore all the data sent to OpenTelemetry Collector.
+
+</@profile.ifCommunity>
+
+<@opts.printRelevantOptions includedOptions="telemetry-*" excludedOptions="telemetry-logs-*">
 
 === Traces
 <@opts.includeOptions includedOptions="tracing-enabled tracing-endpoint tracing-protocol tracing-service-name tracing-resource-attributes"/>
 
+=== Logs
+<@opts.includeOptions includedOptions="telemetry-logs-*"/>
+
 </@opts.printRelevantOptions>
 
 </@tmpl.guide>

docs/guides/server/logging.adoc

@@ -300,7 +300,14 @@ You can use regular expressions to exclude them, such as:
 
 In this case, all calls to the `/realms/my-internal-realm/` and subsequent paths will be excluded from the HTTP Access log.
 
-<@opts.printRelevantOptions includedOptions="log log-*" excludedOptions="log-console-* log-file log-file-* log-syslog-* log-mdc*">
+[[logs-export-opentelemetry]]
+== Telemetry Logs export (OpenTelemetry)
+
+It is possible to export OpenTelemetry logs from your deployment to the OpenTelemetry collector for centralized log management.
+
+For more details, see the link:{telemetryguide_link}[{telemetryguide_name}] guide.
+
+<@opts.printRelevantOptions includedOptions="log log-*" excludedOptions="log-console-* log-file log-file-* log-syslog-* log-mdc* telemetry-logs-*">
 
 === Console
 <@opts.includeOptions includedOptions="log-console-*"/>
@@ -317,6 +324,9 @@ In this case, all calls to the `/realms/my-internal-realm/` and subsequent paths
 === Mapped Diagnostic Context (MDC)
 <@opts.includeOptions includedOptions="log-mdc*"/>
 
+=== Telemetry Logs (OpenTelemetry)
+<@opts.includeOptions includedOptions="telemetry-logs-*"/>
+
 </@opts.printRelevantOptions>
 
 </@tmpl.guide>

quarkus/config-api/src/main/java/org/keycloak/config/TelemetryOptions.java

@@ -33,4 +33,30 @@ public class TelemetryOptions {
             .category(OptionCategory.TELEMETRY)
             .description("OpenTelemetry resource attributes characterize the telemetry producer. Values in format 'key1=val1,key2=val2'.")
             .build();
+
+    // Telemetry Logs
+    public static final Option<Boolean> TELEMETRY_LOGS_ENABLED = new OptionBuilder<>("telemetry-logs-enabled", Boolean.class)
+            .category(OptionCategory.TELEMETRY)
+            .description("Enables exporting logs to a destination handling telemetry data (OpenTelemetry Logs).")
+            .defaultValue(Boolean.FALSE)
+            .buildTime(true)
+            .build();
+
+    public static final Option<String> TELEMETRY_LOGS_ENDPOINT = new OptionBuilder<>("telemetry-logs-endpoint", String.class)
+            .category(OptionCategory.TELEMETRY)
+            .description("Telemetry (OpenTelemetry) endpoint to export logs to. If not given, the value is inherited from the '%s' option.".formatted(TELEMETRY_ENDPOINT.getKey()))
+            .build();
+
+    public static final Option<String> TELEMETRY_LOGS_PROTOCOL = new OptionBuilder<>("telemetry-logs-protocol", String.class)
+            .category(OptionCategory.TELEMETRY)
+            .description("Telemetry (OpenTelemetry) protocol used for exporting logs. If not given, the value is inherited from the '%s' option.".formatted(TELEMETRY_PROTOCOL.getKey()))
+            .expectedValues("grpc", "http/protobuf")
+            .build();
+
+    public static final Option<LoggingOptions.Level> TELEMETRY_LOGS_LEVEL = new OptionBuilder<>("telemetry-logs-level", LoggingOptions.Level.class)
+            .category(OptionCategory.TELEMETRY)
+            .description("The most verbose log level exported to the telemetry endpoint. For more information, check the Telemetry guide.")
+            .defaultValue(LoggingOptions.Level.ALL)
+            .caseInsensitiveExpectedValues(true)
+            .build();
 }

quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/LoggingPropertyMappers.java

@@ -431,7 +431,7 @@ public final class LoggingPropertyMappers implements PropertyMapperGrouping {
         return LoggingOptions.DEFAULT_LOG_FORMAT;
     }
 
-    private static String upperCase(String value, ConfigSourceInterceptorContext context) {
+    static String upperCase(String value, ConfigSourceInterceptorContext context) {
         return value.toUpperCase(Locale.ROOT);
     }
 

quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/TelemetryPropertyMappers.java

@@ -6,6 +6,7 @@ import java.net.URL;
 import java.util.List;
 
 import org.keycloak.common.Profile;
+import org.keycloak.config.TelemetryOptions;
 import org.keycloak.config.TracingOptions;
 import org.keycloak.quarkus.runtime.cli.PropertyException;
 import org.keycloak.quarkus.runtime.configuration.Configuration;
@@ -15,6 +16,10 @@ import io.smallrye.config.ConfigSourceInterceptorContext;
 
 import static org.keycloak.config.TelemetryOptions.TELEMETRY_ENABLED;
 import static org.keycloak.config.TelemetryOptions.TELEMETRY_ENDPOINT;
+import static org.keycloak.config.TelemetryOptions.TELEMETRY_LOGS_ENABLED;
+import static org.keycloak.config.TelemetryOptions.TELEMETRY_LOGS_ENDPOINT;
+import static org.keycloak.config.TelemetryOptions.TELEMETRY_LOGS_LEVEL;
+import static org.keycloak.config.TelemetryOptions.TELEMETRY_LOGS_PROTOCOL;
 import static org.keycloak.config.TelemetryOptions.TELEMETRY_PROTOCOL;
 import static org.keycloak.config.TelemetryOptions.TELEMETRY_RESOURCE_ATTRIBUTES;
 import static org.keycloak.config.TelemetryOptions.TELEMETRY_SERVICE_NAME;
@@ -22,13 +27,15 @@ import static org.keycloak.quarkus.runtime.configuration.mappers.PropertyMapper.
 
 public class TelemetryPropertyMappers implements PropertyMapperGrouping{
     private static final String OTEL_FEATURE_ENABLED_MSG = "'opentelemetry' feature is enabled";
-    private static final String OTEL_COLLECTOR_ENABLED_MSG = "any of available OpenTelemetry components (Traces) is turned on";
+    private static final String OTEL_COLLECTOR_ENABLED_MSG = "any of available OpenTelemetry components (Logs, Traces) is turned on";
+    private static final String OTEL_LOGS_FEATURE_ENABLED_MSG = "feature '%s' is enabled".formatted(Profile.Feature.OPENTELEMETRY_LOGS.getVersionedKey());
+    private static final String OTEL_LOGS_ENABLED_MSG = "Telemetry Logs functionality ('%s') is enabled".formatted(TELEMETRY_LOGS_ENABLED.getKey());
 
     @Override
     public List<? extends PropertyMapper<?>> getPropertyMappers() {
         return List.of(
                 fromOption(TELEMETRY_ENABLED)
-                        .isEnabled(TelemetryPropertyMappers::isFeatureEnabled, OTEL_FEATURE_ENABLED_MSG)
+                        .isEnabled(TelemetryPropertyMappers::isOtelFeatureEnabled, OTEL_FEATURE_ENABLED_MSG)
                         .transformer(TelemetryPropertyMappers::checkIfDependantsAreEnabled)
                         .to("quarkus.otel.enabled")
                         .build(),
@@ -54,25 +61,57 @@ public class TelemetryPropertyMappers implements PropertyMapperGrouping{
                         .isEnabled(TelemetryPropertyMappers::isTelemetryEnabled, OTEL_COLLECTOR_ENABLED_MSG)
                         .to("quarkus.otel.resource.attributes")
                         .paramLabel("attributes")
+                        .build(),
+                // Telemetry Logs
+                fromOption(TELEMETRY_LOGS_ENABLED)
+                        .isEnabled(TelemetryPropertyMappers::isOtelLogsFeatureEnabled, OTEL_LOGS_FEATURE_ENABLED_MSG)
+                        .to("quarkus.otel.logs.enabled")
+                        .build(),
+                fromOption(TELEMETRY_LOGS_ENDPOINT)
+                        .isEnabled(TelemetryPropertyMappers::isTelemetryLogsEnabled, OTEL_LOGS_ENABLED_MSG)
+                        .mapFrom(TelemetryOptions.TELEMETRY_ENDPOINT)
+                        .to("quarkus.otel.exporter.otlp.logs.endpoint")
+                        .validator(TelemetryPropertyMappers::validateEndpoint)
+                        .paramLabel("url")
+                        .build(),
+                fromOption(TELEMETRY_LOGS_PROTOCOL)
+                        .isEnabled(TelemetryPropertyMappers::isTelemetryLogsEnabled, OTEL_LOGS_ENABLED_MSG)
+                        .mapFrom(TelemetryOptions.TELEMETRY_PROTOCOL)
+                        .to("quarkus.otel.exporter.otlp.logs.protocol")
+                        .paramLabel("protocol")
+                        .build(),
+                fromOption(TELEMETRY_LOGS_LEVEL)
+                        .isEnabled(TelemetryPropertyMappers::isTelemetryLogsEnabled, OTEL_LOGS_ENABLED_MSG)
+                        .to("quarkus.otel.logs.level")
+                        .paramLabel("level")
+                        .transformer(LoggingPropertyMappers::upperCase)
                         .build()
         );
     }
 
     private static String checkIfDependantsAreEnabled(String value, ConfigSourceInterceptorContext context) {
-        if (Configuration.isTrue(TracingOptions.TRACING_ENABLED)) {
+        if (TelemetryPropertyMappers.isTelemetryLogsEnabled() || TracingPropertyMappers.isTracingEnabled()) {
             return Boolean.TRUE.toString();
         }
         return Boolean.FALSE.toString();
     }
 
-    private static boolean isFeatureEnabled() {
+    private static boolean isOtelFeatureEnabled() {
         return Profile.isFeatureEnabled(Profile.Feature.OPENTELEMETRY);
     }
 
+    public static boolean isOtelLogsFeatureEnabled() {
+        return Profile.isFeatureEnabled(Profile.Feature.OPENTELEMETRY_LOGS);
+    }
+
     public static boolean isTelemetryEnabled() {
         return Configuration.isTrue("quarkus.otel.enabled");
     }
 
+    public static boolean isTelemetryLogsEnabled() {
+        return Configuration.isTrue("quarkus.otel.logs.enabled");
+    }
+
     static void validateEndpoint(String value) {
         if (StringUtil.isBlank(value)) {
             throw new PropertyException("Specified Endpoint URL must not be empty.");

quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/cli/PicocliTest.java

@@ -1266,7 +1266,7 @@ public class PicocliTest extends AbstractConfigurationTest {
         assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
         assertThat(nonRunningPicocli.getErrString(), anyOf(
                 containsString("Disabled option: '--tracing-service-name'. Available only when Tracing is enabled"),
-                containsString("Disabled option: '--telemetry-service-name'. Available only when any of available OpenTelemetry components (Traces) is turned on")
+                containsString("Disabled option: '--telemetry-service-name'. Available only when any of available OpenTelemetry components (Logs, Traces) is turned on")
         ));
         assertThat(nonRunningPicocli.config.getConfigValue("quarkus.otel.enabled").getValue(), is("false"));
         assertThat(nonRunningPicocli.config.getConfigValue("quarkus.otel.traces.enabled").getValue(), is("false"));
@@ -1276,7 +1276,7 @@ public class PicocliTest extends AbstractConfigurationTest {
         // disabled tracing
         nonRunningPicocli = pseudoLaunch("start-dev", "--telemetry-service-name=service123");
         assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
-        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--telemetry-service-name'. Available only when any of available OpenTelemetry components (Traces) is turned on"));
+        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--telemetry-service-name'. Available only when any of available OpenTelemetry components (Logs, Traces) is turned on"));
         assertThat(nonRunningPicocli.config.getConfigValue("quarkus.otel.enabled").getValue(), is("false"));
         assertThat(nonRunningPicocli.config.getConfigValue("quarkus.otel.traces.enabled").getValue(), is("false"));
         assertThat(nonRunningPicocli.config.getConfigValue("quarkus.otel.service.name").getValue(), is(nullValue()));
@@ -1370,4 +1370,130 @@ public class PicocliTest extends AbstractConfigurationTest {
         assertThat(nonRunningPicocli.config.getConfigValue("quarkus.otel.exporter.otlp.endpoint").getValue(), is("http://keycloak-keycloak-keycloak.org:3455")); // value inherited
         assertThat(nonRunningPicocli.config.getConfigValue("quarkus.otel.exporter.otlp.traces.endpoint").getValue(), is("http://keycloak-keycloak-keycloak.org:3455")); // value inherited
     }
+
+    @Test
+    public void otelLogs() {
+        // parent feature disabled
+        NonRunningPicocli nonRunningPicocli = pseudoLaunch("start-dev", "--feature-opentelemetry=disabled", "--feature-opentelemetry-logs=enabled");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("ERROR: Feature opentelemetry-logs depends on disabled feature opentelemetry"));
+        onAfter();
+
+        // feature disabled
+        nonRunningPicocli = pseudoLaunch("start-dev", "--telemetry-logs-enabled=true");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--telemetry-logs-enabled'. Available only when feature 'opentelemetry-logs:v1' is enabled"));
+        onAfter();
+
+        // export disabled
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=false", "--telemetry-logs-protocol=http/protobuf");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Disabled option: '--telemetry-logs-protocol'. Available only when Telemetry Logs functionality ('telemetry-logs-enabled') is enabled"));
+        onAfter();
+
+        // check enabled
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertExternalConfig(Map.of(
+                "quarkus.otel.enabled", "true",
+                "quarkus.otel.logs.enabled", "true"
+        ));
+        onAfter();
+
+        // multiple components enabled
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--tracing-enabled=false");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertExternalConfig(Map.of(
+                "quarkus.otel.enabled", "true",
+                "quarkus.otel.logs.enabled", "true",
+                "quarkus.otel.traces.enabled", "false"
+        ));
+        onAfter();
+
+        // wrong protocol
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--telemetry-logs-protocol=wrong");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Invalid value for option '--telemetry-logs-protocol': wrong. Expected values are: grpc, http/protobuf"));
+        onAfter();
+
+        // otel protocol
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--telemetry-logs-protocol=http/protobuf");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertExternalConfig(Map.of(
+                "quarkus.otel.enabled", "true",
+                "quarkus.otel.exporter.otlp.logs.protocol", "http/protobuf"
+        ));
+        onAfter();
+
+        // parent + child protocol
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--telemetry-logs-protocol=http/protobuf", "--telemetry-protocol=grpc");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertExternalConfig(Map.of(
+                "quarkus.otel.enabled", "true",
+                "quarkus.otel.exporter.otlp.protocol", "grpc",
+                "quarkus.otel.exporter.otlp.logs.protocol", "http/protobuf"
+        ));
+        onAfter();
+
+        // parent protocol
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--telemetry-protocol=http/protobuf");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertExternalConfig(Map.of(
+                "quarkus.otel.enabled", "true",
+                "quarkus.otel.exporter.otlp.protocol", "http/protobuf",
+                "quarkus.otel.exporter.otlp.logs.protocol", "http/protobuf"
+        ));
+        onAfter();
+
+        // wrong parent endpoint
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--telemetry-endpoint=not-url");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Specified Endpoint URL is invalid"));
+        onAfter();
+
+        // wrong endpoint
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--telemetry-logs-endpoint=not-url");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Specified Endpoint URL is invalid"));
+        onAfter();
+
+        // otel endpoint
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--telemetry-logs-endpoint=http://keycloak.org");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertExternalConfig("quarkus.otel.exporter.otlp.logs.endpoint", "http://keycloak.org");
+        onAfter();
+
+        // parent + child endpoint
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--telemetry-endpoint=http://keycloak-keycloak-keycloak.org:3455", "--telemetry-logs-endpoint=http://keycloak.org");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertExternalConfig(Map.of(
+                "quarkus.otel.exporter.otlp.endpoint", "http://keycloak-keycloak-keycloak.org:3455",
+                "quarkus.otel.exporter.otlp.logs.endpoint", "http://keycloak.org"
+        ));
+        onAfter();
+
+        // parent endpoint
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--telemetry-endpoint=http://keycloak-keycloak-keycloak.org:3455");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertExternalConfig(Map.of(
+                "quarkus.otel.exporter.otlp.endpoint", "http://keycloak-keycloak-keycloak.org:3455",
+                "quarkus.otel.exporter.otlp.logs.endpoint", "http://keycloak-keycloak-keycloak.org:3455"
+        ));
+        onAfter();
+
+        // wrong level
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--telemetry-logs-level=wrong");
+        assertEquals(CommandLine.ExitCode.USAGE, nonRunningPicocli.exitCode);
+        assertThat(nonRunningPicocli.getErrString(), containsString("Invalid value for option '--telemetry-logs-level': wrong. Expected values are (case insensitive): off, fatal, error, warn, info, debug, trace, all"));
+        onAfter();
+
+        // level
+        nonRunningPicocli = pseudoLaunch("start-dev", "--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--telemetry-logs-level=debug");
+        assertEquals(CommandLine.ExitCode.OK, nonRunningPicocli.exitCode);
+        assertExternalConfig(Map.of(
+                "quarkus.otel.enabled", "true",
+                "quarkus.otel.logs.enabled", "true",
+                "quarkus.otel.logs.level", "DEBUG"
+        ));
+    }
 }

quarkus/runtime/src/test/java/org/keycloak/quarkus/runtime/configuration/TelemetryConfigurationTest.java

@@ -68,4 +68,60 @@ public class TelemetryConfigurationTest extends AbstractConfigurationTest {
                 "quarkus.otel.resource.attributes", "val3=hello3"
         ));
     }
+
+    @Test
+    public void logsDefault() {
+        initConfig();
+
+        assertConfig(Map.of(
+                "telemetry-logs-enabled", "false",
+                "telemetry-logs-endpoint", "http://localhost:4317",
+                "telemetry-logs-protocol", "grpc",
+                "telemetry-logs-level", "all"
+        ));
+
+        assertExternalConfig(Map.of(
+                "quarkus.otel.logs.enabled", "false",
+                "quarkus.otel.enabled", "false",
+                "quarkus.otel.exporter.otlp.logs.endpoint", "http://localhost:4317",
+                "quarkus.otel.exporter.otlp.logs.protocol", "grpc",
+                "quarkus.otel.logs.level","ALL"
+        ));
+    }
+
+    @Test
+    public void logsPriority() {
+        ConfigArgsConfigSource.setCliArgs("--features=opentelemetry-logs", "--telemetry-logs-enabled=true", "--telemetry-logs-endpoint=localhost:2000", "--telemetry-logs-protocol=http/protobuf", "--telemetry-logs-level=warn");
+        initConfig();
+        assertConfig(Map.of(
+                "telemetry-logs-enabled", "true",
+                "telemetry-logs-endpoint", "localhost:2000",
+                "telemetry-logs-protocol", "http/protobuf",
+                "telemetry-logs-level", "warn"
+        ));
+        assertExternalConfig(Map.of(
+                "quarkus.otel.logs.enabled", "true",
+                "quarkus.otel.enabled", "true",
+                "quarkus.otel.exporter.otlp.logs.endpoint", "localhost:2000",
+                "quarkus.otel.exporter.otlp.logs.protocol", "http/protobuf",
+                "quarkus.otel.logs.level","WARN"
+        ));
+        onAfter();
+
+        ConfigArgsConfigSource.setCliArgs("--features=opentelemetry-logs", "--telemetry-endpoint=http://keycloak.org:1234", "--telemetry-protocol=grpc", "--telemetry-logs-enabled=true", "--telemetry-logs-endpoint=my-domain:2001", "--telemetry-logs-protocol=http/protobuf");
+        initConfig();
+        assertConfig(Map.of(
+                "telemetry-logs-enabled", "true",
+                "telemetry-logs-endpoint", "my-domain:2001",
+                "telemetry-logs-protocol", "http/protobuf",
+                "telemetry-endpoint", "http://keycloak.org:1234",
+                "telemetry-protocol", "grpc"
+        ));
+        assertExternalConfig(Map.of(
+                "quarkus.otel.logs.enabled", "true",
+                "quarkus.otel.enabled", "true",
+                "quarkus.otel.exporter.otlp.logs.endpoint", "my-domain:2001",
+                "quarkus.otel.exporter.otlp.logs.protocol", "http/protobuf"
+        ));
+    }
 }

quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/LoggingDistTest.java

@@ -303,4 +303,14 @@ public class LoggingDistTest {
                 .statusCode(200);
         cliResult.assertNoMessage("http://127.0.0.1:8080/realms/master/clients/account/redirect");
     }
+
+    // Telemetry Logs
+    @Test
+    @Launch({"start-dev", "--feature-opentelemetry-logs=enabled", "--telemetry-logs-enabled=true", "--log-level=io.opentelemetry:fine"})
+    void telemetryLogsEnabled(CLIResult cliResult) {
+        cliResult.assertStartedDevMode();
+        cliResult.assertMessage("opentelemetry");
+        cliResult.assertMessage("service.name=\"keycloak\"");
+        cliResult.assertMessage("Failed to export LogsRequestMarshaler.");
+    }
 }

quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testExportHelpAll.approved.txt

@@ -313,21 +313,41 @@ Telemetry (OpenTelemetry):
 
 --telemetry-endpoint <url>
                      OpenTelemetry endpoint to connect to. Default: http://localhost:4317.
-                       Available only when any of available OpenTelemetry components (Traces) is
+                       Available only when any of available OpenTelemetry components (Logs, Traces)
-                       turned on.
+                       is turned on.
+--telemetry-logs-enabled <true|false>
+                     Enables exporting logs to a destination handling telemetry data (OpenTelemetry
+                       Logs). Default: false. Available only when feature 'opentelemetry-logs:v1'
+                       is enabled.
+--telemetry-logs-endpoint <url>
+                     Telemetry (OpenTelemetry) endpoint to export logs to. If not given, the value
+                       is inherited from the 'telemetry-endpoint' option. Available only when
+                       Telemetry Logs functionality ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-level <level>
+                     The most verbose log level exported to the telemetry endpoint. For more
+                       information, check the Telemetry guide. Possible values are (case
+                       insensitive): off, fatal, error, warn, info, debug, trace, all. Default:
+                       all. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-protocol <protocol>
+                     Telemetry (OpenTelemetry) protocol used for exporting logs. If not given, the
+                       value is inherited from the 'telemetry-protocol' option. Possible values
+                       are: grpc, http/protobuf. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
 --telemetry-protocol <protocol>
                      OpenTelemetry protocol used for the communication between server and
                        OpenTelemetry collector. Possible values are: grpc, http/protobuf. Default:
-                       grpc. Available only when any of available OpenTelemetry components (Traces)
+                       grpc. Available only when any of available OpenTelemetry components (Logs,
-                       is turned on.
+                       Traces) is turned on.
 --telemetry-resource-attributes <attributes>
                      OpenTelemetry resource attributes characterize the telemetry producer. Values
                        in format 'key1=val1,key2=val2'. Available only when any of available
-                       OpenTelemetry components (Traces) is turned on.
+                       OpenTelemetry components (Logs, Traces) is turned on.
 --telemetry-service-name <name>
                      OpenTelemetry service name. Takes precedence over 'service.name' defined in
                        the 'telemetry-resource-attributes' property. Default: keycloak. Available
-                       only when any of available OpenTelemetry components (Traces) is turned on.
+                       only when any of available OpenTelemetry components (Logs, Traces) is turned
+                       on.
 
 Tracing:
 

quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testImportHelpAll.approved.txt

@@ -313,21 +313,41 @@ Telemetry (OpenTelemetry):
 
 --telemetry-endpoint <url>
                      OpenTelemetry endpoint to connect to. Default: http://localhost:4317.
-                       Available only when any of available OpenTelemetry components (Traces) is
+                       Available only when any of available OpenTelemetry components (Logs, Traces)
-                       turned on.
+                       is turned on.
+--telemetry-logs-enabled <true|false>
+                     Enables exporting logs to a destination handling telemetry data (OpenTelemetry
+                       Logs). Default: false. Available only when feature 'opentelemetry-logs:v1'
+                       is enabled.
+--telemetry-logs-endpoint <url>
+                     Telemetry (OpenTelemetry) endpoint to export logs to. If not given, the value
+                       is inherited from the 'telemetry-endpoint' option. Available only when
+                       Telemetry Logs functionality ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-level <level>
+                     The most verbose log level exported to the telemetry endpoint. For more
+                       information, check the Telemetry guide. Possible values are (case
+                       insensitive): off, fatal, error, warn, info, debug, trace, all. Default:
+                       all. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-protocol <protocol>
+                     Telemetry (OpenTelemetry) protocol used for exporting logs. If not given, the
+                       value is inherited from the 'telemetry-protocol' option. Possible values
+                       are: grpc, http/protobuf. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
 --telemetry-protocol <protocol>
                      OpenTelemetry protocol used for the communication between server and
                        OpenTelemetry collector. Possible values are: grpc, http/protobuf. Default:
-                       grpc. Available only when any of available OpenTelemetry components (Traces)
+                       grpc. Available only when any of available OpenTelemetry components (Logs,
-                       is turned on.
+                       Traces) is turned on.
 --telemetry-resource-attributes <attributes>
                      OpenTelemetry resource attributes characterize the telemetry producer. Values
                        in format 'key1=val1,key2=val2'. Available only when any of available
-                       OpenTelemetry components (Traces) is turned on.
+                       OpenTelemetry components (Logs, Traces) is turned on.
 --telemetry-service-name <name>
                      OpenTelemetry service name. Takes precedence over 'service.name' defined in
                        the 'telemetry-resource-attributes' property. Default: keycloak. Available
-                       only when any of available OpenTelemetry components (Traces) is turned on.
+                       only when any of available OpenTelemetry components (Logs, Traces) is turned
+                       on.
 
 Tracing:
 

quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartDevHelpAll.approved.txt

@@ -640,21 +640,41 @@ Telemetry (OpenTelemetry):
 
 --telemetry-endpoint <url>
                      OpenTelemetry endpoint to connect to. Default: http://localhost:4317.
-                       Available only when any of available OpenTelemetry components (Traces) is
+                       Available only when any of available OpenTelemetry components (Logs, Traces)
-                       turned on.
+                       is turned on.
+--telemetry-logs-enabled <true|false>
+                     Enables exporting logs to a destination handling telemetry data (OpenTelemetry
+                       Logs). Default: false. Available only when feature 'opentelemetry-logs:v1'
+                       is enabled.
+--telemetry-logs-endpoint <url>
+                     Telemetry (OpenTelemetry) endpoint to export logs to. If not given, the value
+                       is inherited from the 'telemetry-endpoint' option. Available only when
+                       Telemetry Logs functionality ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-level <level>
+                     The most verbose log level exported to the telemetry endpoint. For more
+                       information, check the Telemetry guide. Possible values are (case
+                       insensitive): off, fatal, error, warn, info, debug, trace, all. Default:
+                       all. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-protocol <protocol>
+                     Telemetry (OpenTelemetry) protocol used for exporting logs. If not given, the
+                       value is inherited from the 'telemetry-protocol' option. Possible values
+                       are: grpc, http/protobuf. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
 --telemetry-protocol <protocol>
                      OpenTelemetry protocol used for the communication between server and
                        OpenTelemetry collector. Possible values are: grpc, http/protobuf. Default:
-                       grpc. Available only when any of available OpenTelemetry components (Traces)
+                       grpc. Available only when any of available OpenTelemetry components (Logs,
-                       is turned on.
+                       Traces) is turned on.
 --telemetry-resource-attributes <attributes>
                      OpenTelemetry resource attributes characterize the telemetry producer. Values
                        in format 'key1=val1,key2=val2'. Available only when any of available
-                       OpenTelemetry components (Traces) is turned on.
+                       OpenTelemetry components (Logs, Traces) is turned on.
 --telemetry-service-name <name>
                      OpenTelemetry service name. Takes precedence over 'service.name' defined in
                        the 'telemetry-resource-attributes' property. Default: keycloak. Available
-                       only when any of available OpenTelemetry components (Traces) is turned on.
+                       only when any of available OpenTelemetry components (Logs, Traces) is turned
+                       on.
 
 Tracing:
 

quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartHelpAll.approved.txt

@@ -641,21 +641,41 @@ Telemetry (OpenTelemetry):
 
 --telemetry-endpoint <url>
                      OpenTelemetry endpoint to connect to. Default: http://localhost:4317.
-                       Available only when any of available OpenTelemetry components (Traces) is
+                       Available only when any of available OpenTelemetry components (Logs, Traces)
-                       turned on.
+                       is turned on.
+--telemetry-logs-enabled <true|false>
+                     Enables exporting logs to a destination handling telemetry data (OpenTelemetry
+                       Logs). Default: false. Available only when feature 'opentelemetry-logs:v1'
+                       is enabled.
+--telemetry-logs-endpoint <url>
+                     Telemetry (OpenTelemetry) endpoint to export logs to. If not given, the value
+                       is inherited from the 'telemetry-endpoint' option. Available only when
+                       Telemetry Logs functionality ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-level <level>
+                     The most verbose log level exported to the telemetry endpoint. For more
+                       information, check the Telemetry guide. Possible values are (case
+                       insensitive): off, fatal, error, warn, info, debug, trace, all. Default:
+                       all. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-protocol <protocol>
+                     Telemetry (OpenTelemetry) protocol used for exporting logs. If not given, the
+                       value is inherited from the 'telemetry-protocol' option. Possible values
+                       are: grpc, http/protobuf. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
 --telemetry-protocol <protocol>
                      OpenTelemetry protocol used for the communication between server and
                        OpenTelemetry collector. Possible values are: grpc, http/protobuf. Default:
-                       grpc. Available only when any of available OpenTelemetry components (Traces)
+                       grpc. Available only when any of available OpenTelemetry components (Logs,
-                       is turned on.
+                       Traces) is turned on.
 --telemetry-resource-attributes <attributes>
                      OpenTelemetry resource attributes characterize the telemetry producer. Values
                        in format 'key1=val1,key2=val2'. Available only when any of available
-                       OpenTelemetry components (Traces) is turned on.
+                       OpenTelemetry components (Logs, Traces) is turned on.
 --telemetry-service-name <name>
                      OpenTelemetry service name. Takes precedence over 'service.name' defined in
                        the 'telemetry-resource-attributes' property. Default: keycloak. Available
-                       only when any of available OpenTelemetry components (Traces) is turned on.
+                       only when any of available OpenTelemetry components (Logs, Traces) is turned
+                       on.
 
 Tracing:
 

quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testStartOptimizedHelpAll.approved.txt

@@ -567,21 +567,37 @@ Telemetry (OpenTelemetry):
 
 --telemetry-endpoint <url>
                      OpenTelemetry endpoint to connect to. Default: http://localhost:4317.
-                       Available only when any of available OpenTelemetry components (Traces) is
+                       Available only when any of available OpenTelemetry components (Logs, Traces)
-                       turned on.
+                       is turned on.
+--telemetry-logs-endpoint <url>
+                     Telemetry (OpenTelemetry) endpoint to export logs to. If not given, the value
+                       is inherited from the 'telemetry-endpoint' option. Available only when
+                       Telemetry Logs functionality ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-level <level>
+                     The most verbose log level exported to the telemetry endpoint. For more
+                       information, check the Telemetry guide. Possible values are (case
+                       insensitive): off, fatal, error, warn, info, debug, trace, all. Default:
+                       all. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-protocol <protocol>
+                     Telemetry (OpenTelemetry) protocol used for exporting logs. If not given, the
+                       value is inherited from the 'telemetry-protocol' option. Possible values
+                       are: grpc, http/protobuf. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
 --telemetry-protocol <protocol>
                      OpenTelemetry protocol used for the communication between server and
                        OpenTelemetry collector. Possible values are: grpc, http/protobuf. Default:
-                       grpc. Available only when any of available OpenTelemetry components (Traces)
+                       grpc. Available only when any of available OpenTelemetry components (Logs,
-                       is turned on.
+                       Traces) is turned on.
 --telemetry-resource-attributes <attributes>
                      OpenTelemetry resource attributes characterize the telemetry producer. Values
                        in format 'key1=val1,key2=val2'. Available only when any of available
-                       OpenTelemetry components (Traces) is turned on.
+                       OpenTelemetry components (Logs, Traces) is turned on.
 --telemetry-service-name <name>
                      OpenTelemetry service name. Takes precedence over 'service.name' defined in
                        the 'telemetry-resource-attributes' property. Default: keycloak. Available
-                       only when any of available OpenTelemetry components (Traces) is turned on.
+                       only when any of available OpenTelemetry components (Logs, Traces) is turned
+                       on.
 
 Tracing:
 

quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityCheckHelpAll.approved.txt

@@ -640,21 +640,41 @@ Telemetry (OpenTelemetry):
 
 --telemetry-endpoint <url>
                      OpenTelemetry endpoint to connect to. Default: http://localhost:4317.
-                       Available only when any of available OpenTelemetry components (Traces) is
+                       Available only when any of available OpenTelemetry components (Logs, Traces)
-                       turned on.
+                       is turned on.
+--telemetry-logs-enabled <true|false>
+                     Enables exporting logs to a destination handling telemetry data (OpenTelemetry
+                       Logs). Default: false. Available only when feature 'opentelemetry-logs:v1'
+                       is enabled.
+--telemetry-logs-endpoint <url>
+                     Telemetry (OpenTelemetry) endpoint to export logs to. If not given, the value
+                       is inherited from the 'telemetry-endpoint' option. Available only when
+                       Telemetry Logs functionality ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-level <level>
+                     The most verbose log level exported to the telemetry endpoint. For more
+                       information, check the Telemetry guide. Possible values are (case
+                       insensitive): off, fatal, error, warn, info, debug, trace, all. Default:
+                       all. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-protocol <protocol>
+                     Telemetry (OpenTelemetry) protocol used for exporting logs. If not given, the
+                       value is inherited from the 'telemetry-protocol' option. Possible values
+                       are: grpc, http/protobuf. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
 --telemetry-protocol <protocol>
                      OpenTelemetry protocol used for the communication between server and
                        OpenTelemetry collector. Possible values are: grpc, http/protobuf. Default:
-                       grpc. Available only when any of available OpenTelemetry components (Traces)
+                       grpc. Available only when any of available OpenTelemetry components (Logs,
-                       is turned on.
+                       Traces) is turned on.
 --telemetry-resource-attributes <attributes>
                      OpenTelemetry resource attributes characterize the telemetry producer. Values
                        in format 'key1=val1,key2=val2'. Available only when any of available
-                       OpenTelemetry components (Traces) is turned on.
+                       OpenTelemetry components (Logs, Traces) is turned on.
 --telemetry-service-name <name>
                      OpenTelemetry service name. Takes precedence over 'service.name' defined in
                        the 'telemetry-resource-attributes' property. Default: keycloak. Available
-                       only when any of available OpenTelemetry components (Traces) is turned on.
+                       only when any of available OpenTelemetry components (Logs, Traces) is turned
+                       on.
 
 Tracing:
 

quarkus/tests/integration/src/test/resources/org/keycloak/it/cli/dist/approvals/cli/help/HelpCommandDistTest.testUpdateCompatibilityMetadataHelpAll.approved.txt

@@ -638,21 +638,41 @@ Telemetry (OpenTelemetry):
 
 --telemetry-endpoint <url>
                      OpenTelemetry endpoint to connect to. Default: http://localhost:4317.
-                       Available only when any of available OpenTelemetry components (Traces) is
+                       Available only when any of available OpenTelemetry components (Logs, Traces)
-                       turned on.
+                       is turned on.
+--telemetry-logs-enabled <true|false>
+                     Enables exporting logs to a destination handling telemetry data (OpenTelemetry
+                       Logs). Default: false. Available only when feature 'opentelemetry-logs:v1'
+                       is enabled.
+--telemetry-logs-endpoint <url>
+                     Telemetry (OpenTelemetry) endpoint to export logs to. If not given, the value
+                       is inherited from the 'telemetry-endpoint' option. Available only when
+                       Telemetry Logs functionality ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-level <level>
+                     The most verbose log level exported to the telemetry endpoint. For more
+                       information, check the Telemetry guide. Possible values are (case
+                       insensitive): off, fatal, error, warn, info, debug, trace, all. Default:
+                       all. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
+--telemetry-logs-protocol <protocol>
+                     Telemetry (OpenTelemetry) protocol used for exporting logs. If not given, the
+                       value is inherited from the 'telemetry-protocol' option. Possible values
+                       are: grpc, http/protobuf. Available only when Telemetry Logs functionality
+                       ('telemetry-logs-enabled') is enabled.
 --telemetry-protocol <protocol>
                      OpenTelemetry protocol used for the communication between server and
                        OpenTelemetry collector. Possible values are: grpc, http/protobuf. Default:
-                       grpc. Available only when any of available OpenTelemetry components (Traces)
+                       grpc. Available only when any of available OpenTelemetry components (Logs,
-                       is turned on.
+                       Traces) is turned on.
 --telemetry-resource-attributes <attributes>
                      OpenTelemetry resource attributes characterize the telemetry producer. Values
                        in format 'key1=val1,key2=val2'. Available only when any of available
-                       OpenTelemetry components (Traces) is turned on.
+                       OpenTelemetry components (Logs, Traces) is turned on.
 --telemetry-service-name <name>
                      OpenTelemetry service name. Takes precedence over 'service.name' defined in
                        the 'telemetry-resource-attributes' property. Default: keycloak. Available
-                       only when any of available OpenTelemetry components (Traces) is turned on.
+                       only when any of available OpenTelemetry components (Logs, Traces) is turned
+                       on.
 
 Tracing: