Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ECS format - Log event field order does not seem to comply with the ECS standard #260

Open
aduursma opened this issue Aug 28, 2023 · 1 comment
Labels
good first issue Good for newcomers

Comments

@aduursma
Copy link

On the page below I read about the benefits of ECS logging:
https://www.elastic.co/guide/en/ecs-logging/overview/current/intro.html#_why_ecs_logging

Particularly:

Decently human-readable JSON structure

The first three fields are @timestamp, log.level and message. This lets you easily read the logs in a terminal without needing a tool that converts the logs to plain-text.

The above, however, does not seem to be the case.

For example, log.logger is the second field printed and the message field comes almost last.

Is there a way in which the order of the log event fields can be updated so at least the first three fields printed are @timestamp, log.level and message?

@SlyngDK
Copy link
Contributor

SlyngDK commented Aug 29, 2023

I was not aware of this recommendation.
I think it is just about changing the order of the fields here

providers.add(new LoggerNameJsonProvider(config.fields.loggerName, "log.logger"));

You are welcome to create a PR, with the change.

@SlyngDK SlyngDK added the good first issue Good for newcomers label Aug 29, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

2 participants