MuleSoft Observability 360: Logs, Metrics, and Traces with ELK Stack

When an API goes down at midnight, logs alone won’t save you. You need logs + metrics + traces to see:

• Where the error happened
• Why latency is spiking
• Which flow is the bottleneck

That’s where MuleSoft Observability 360 with ELK (Elasticsearch, Logstash, Kibana) comes in. In this article, we’ll show you how to connect MuleSoft runtimes to ELK with real config snippets, so you can replicate it in your projects.

Logs: Centralizing Mule Runtime Logs

By default, Mule logs are stored locally (/var/logs/mule). In distributed runtimes, this means jumping across servers. ELK solves this by centralizing logs.

Step 1: Enable JSON Logging in Mule

Edit log4j2.xml in your Mule app:

<Appenders>
   <Console name="Console" target="SYSTEM_OUT">
      <PatternLayout pattern="%d{ISO8601} %-5p [%t] %c: %m%n"/>
   </Console>
   <RollingFile name="File" fileName="${sys:mule.home}/logs/mule-app.log">
      <JSONLayout compact="true" eventEol="true"/>
   </RollingFile>
</Appenders>

This outputs logs in JSON for easy parsing in ELK.

Step 2: Configure Filebeat to Ship Logs

Install Filebeat on Mule servers and add this config (filebeat.yml):

filebeat.inputs:
  - type: log
    paths:
      - /opt/mule/logs/mule-app.log
    json.keys_under_root: true
    json.add_error_key: true

output.elasticsearch:
  hosts: ["http://elasticsearch:9200"]

Now Mule logs stream into Elasticsearch.

Metrics: Monitoring Performance at Scale

Logs tell you what happened; metrics tell you how often it happens.

Step 1: Expose Mule Runtime JMX Metrics

In wrapper.conf add:

wrapper.java.additional.15=-Dcom.sun.management.jmxremote
wrapper.java.additional.16=-Dcom.sun.management.jmxremote.port=9010
wrapper.java.additional.17=-Dcom.sun.management.jmxremote.authenticate=false
wrapper.java.additional.18=-Dcom.sun.management.jmxremote.ssl=false

Step 2: Ship Metrics with Metricbeat

In metricbeat.yml:

metricbeat.modules:
  - module: jolokia
    metricsets: ["jmx"]
    hosts: ["http://mule-runtime:9010/jolokia/"]
    namespace: "mule"
    jmx.mappings:
      - mbean: "java.lang:type=Memory"
        attributes:
          - attr: HeapMemoryUsage
            field: heap_usage

Now you can monitor JVM heap usage and response times in Kibana dashboards.

Traces: Following the Request Across Flows

Logs and metrics are great, but traces show the request journey across APIs.

Step 1: Add Mule Telemetry Exporter

Add dependency in pom.xml:

<dependency>
  <groupId>com.mulesoft.telemetry</groupId>
  <artifactId>mule-telemetry-exporter</artifactId>
  <version>1.3.0</version>
</dependency>

Step 2: Configure OpenTelemetry Exporter

In mule-artifact.json:

{
  "configs": [
    {
      "name": "otel-exporter",
      "type": "opentelemetry",
      "parameters": {
        "endpoint": "http://otel-collector:4317",
        "service.name": "orders-api"
      }
    }
  ]
}

Step 3: Add Business Context to Traces

In Mule flow XML:

<set-variable variableName="customerId" value="#[payload.customerId]" />
<tracing:add-attribute key="customerId" value="#[vars.customerId]" />
<tracing:add-attribute key="transactionType" value="#[payload.txType]" />

Now every trace span carries business identifiers, making debugging meaningful.

Real-World Scenario: Debugging a Slow Order API

You receive alerts: Orders API latency > 2s.

• Logs show TimeoutException but not the root cause.
• Metrics show JVM usage fine → not infra issue.
• Traces reveal:
  • orderFlow → 80ms
  • paymentService → 120ms
  • fraudCheckService → 2.1s
  • inventoryUpdate skipped

The culprit? FraudCheck API latency. Without tracing, you’d still be guessing.

Important things to Remember

• Format logs in JSON for easy parsing.
• Use sampling for traces to reduce noise.
• Mask PII in attributes before shipping to ELK.
• Create dashboards by API (orders, payments, inventory) instead of generic charts.
• Set alerts in Kibana (e.g., API latency > 500ms for 5 minutes).

FAQs

Do I need all 3 (logs, metrics, traces)?
Yes. Logs = details, Metrics = patterns, Traces = journey. Together they give observability.

Can ELK replace Anypoint Monitoring?
ELK is more customizable. Many teams run both — Anypoint for quick insights, ELK for deep analysis.

How do I visualize traces?
Kibana APM dashboards can show trace trees (span by span).

Is ELK cloud-ready?
Yes — you can use Elastic Cloud or AWS OpenSearch Service.

With ELK, you don’t just monitor MuleSoft — you gain end-to-end observability. Logs help you investigate failures, metrics show system health, and traces connect the dots across APIs. In 2025, that’s the only way to keep distributed integrations reliable and performant.