How can I change the format of the logs from the tracing package?

By default, all the logs from the tracing package (such as com.couchbase.tracing][OverThresholdRequestsRecordedEvent) are JSON documents such as

{
  "kv": {
    "top_requests": [
      {
        "operation_name": "get",
        "last_dispatch_duration_us": 113274,
        "last_remote_socket": "xxx:11210",
        "last_local_id": "78C03F4700000001/000000008AA7BA2A",
        "last_local_socket": "xxx:49908",
        "total_dispatch_duration_us": 113274,
        "total_server_duration_us": 19,
        "operation_id": "0x152f3",
        "timeout_ms": 250,
        "last_server_duration_us": 19,
        "total_duration_us": 113388
      }
    ],
    "total_count": 1
  }
}

As I use Splunk to process my logs, It is highly preferred to have the logs with the format field=value

I am aware that Splunk can format JSON documents at runtime, but that adds a great overhead to our processing time. We also need separate parsing queries per tracing event

Is there any recommended approach to do this?

As an initial approach, I was thinking to subscribe to the Couchbase Event bus and format it there. But I am not sure if that’s the best approach

clusterEnvironment.eventBus().subscribe(e-> {

            if (e instanceof OverThresholdRequestsRecordedEvent){
                // format
            }

        });