|
1 | 1 | {
|
2 |
| - "version": 1.0, |
3 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/index.html", |
4 |
| - "ecs": { |
5 |
| - "version": "1.x" |
6 |
| - }, |
7 |
| - "fields": { |
8 |
| - "@timestamp": { |
9 |
| - "type": "datetime", |
10 |
| - "required": true, |
11 |
| - "index": 0, |
12 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html" |
13 |
| - }, |
14 |
| - "log.level": { |
15 |
| - "type": "string", |
16 |
| - "required": true, |
17 |
| - "index": 1, |
18 |
| - "top_level_field": true, |
19 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-log.html", |
20 |
| - "comment": [ |
21 |
| - "This field SHOULD NOT be a nested object field but at the top level with a dot in the property name.", |
22 |
| - "This is to make the JSON logs more human-readable.", |
23 |
| - "Loggers MAY indent the log level so that the `message` field always starts at the exact same offset,", |
24 |
| - "no matter the number of characters the log level has.", |
25 |
| - "For example: `'DEBUG'` (5 chars) will not be indented, whereas ` 'WARN'` (4 chars) will be indented by one space character." |
26 |
| - ] |
27 |
| - }, |
28 |
| - "message": { |
29 |
| - "type": "string", |
30 |
| - "required": true, |
31 |
| - "index": 2, |
32 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html" |
33 |
| - }, |
34 |
| - "ecs.version": { |
35 |
| - "type": "string", |
36 |
| - "required": true, |
37 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-ecs.html" |
38 |
| - }, |
39 |
| - "labels": { |
40 |
| - "type": "object", |
41 |
| - "required": false, |
42 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html", |
43 |
| - "sanitization": { |
44 |
| - "key": { |
45 |
| - "replacements": [".", "*", "\\"], |
46 |
| - "substitute": "_" |
| 2 | + "version": 1.0, |
| 3 | + "url": "https://www.elastic.co/guide/en/ecs/current/index.html", |
| 4 | + "ecs": { |
| 5 | + "version": "1.x" |
| 6 | + }, |
| 7 | + "fields": { |
| 8 | + "@timestamp": { |
| 9 | + "type": "datetime", |
| 10 | + "required": true, |
| 11 | + "index": 0, |
| 12 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html", |
| 13 | + "comment": [ |
| 14 | + "Field order, as specified by 'index', is RECOMMENDED.", |
| 15 | + "ECS loggers must implement field order unless the logging framework makes that impossible." |
| 16 | + ] |
| 17 | + }, |
| 18 | + "log.level": { |
| 19 | + "type": "string", |
| 20 | + "required": true, |
| 21 | + "index": 1, |
| 22 | + "top_level_field": true, |
| 23 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-log.html", |
| 24 | + "comment": [ |
| 25 | + "This field SHOULD NOT be a nested object field but at the top level with a dot in the property name.", |
| 26 | + "This is to make the JSON logs more human-readable.", |
| 27 | + "Loggers MAY indent the log level so that the `message` field always starts at the exact same offset,", |
| 28 | + "no matter the number of characters the log level has.", |
| 29 | + "For example: `'DEBUG'` (5 chars) will not be indented, whereas ` 'WARN'` (4 chars) will be indented by one space character." |
| 30 | + ] |
| 31 | + }, |
| 32 | + "message": { |
| 33 | + "type": "string", |
| 34 | + "required": true, |
| 35 | + "index": 2, |
| 36 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html" |
| 37 | + }, |
| 38 | + "ecs.version": { |
| 39 | + "type": "string", |
| 40 | + "required": true, |
| 41 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-ecs.html" |
| 42 | + }, |
| 43 | + "labels": { |
| 44 | + "type": "object", |
| 45 | + "required": false, |
| 46 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html", |
| 47 | + "sanitization": { |
| 48 | + "key": { |
| 49 | + "replacements": [".", "*", "\\"], |
| 50 | + "substitute": "_" |
| 51 | + } |
| 52 | + } |
| 53 | + }, |
| 54 | + "trace.id": { |
| 55 | + "type": "string", |
| 56 | + "required": false, |
| 57 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-tracing.html", |
| 58 | + "comment": "When APM agents add this field to the context, ecs loggers should pick it up and add it to the log event." |
| 59 | + }, |
| 60 | + "transaction.id": { |
| 61 | + "type": "string", |
| 62 | + "required": false, |
| 63 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-tracing.html", |
| 64 | + "comment": "When APM agents add this field to the context, ecs loggers should pick it up and add it to the log event." |
| 65 | + }, |
| 66 | + "service.name": { |
| 67 | + "type": "string", |
| 68 | + "required": false, |
| 69 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-service.html", |
| 70 | + "comment": [ |
| 71 | + "Configurable by users.", |
| 72 | + "When an APM agent is active, they should auto-configure it if not already set." |
| 73 | + ] |
| 74 | + }, |
| 75 | + "event.dataset": { |
| 76 | + "type": "string", |
| 77 | + "required": false, |
| 78 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-event.html", |
| 79 | + "default": "${service.name}.log OR ${service.name}.${appender.name}", |
| 80 | + "comment": [ |
| 81 | + "Configurable by users.", |
| 82 | + "If the user manually configures the service name,", |
| 83 | + "the logging library should set `event.dataset=${service.name}.log` if not explicitly configured otherwise.", |
| 84 | + "", |
| 85 | + "When agents auto-configure the app to use an ECS logger,", |
| 86 | + "they should set `event.dataset=${service.name}.${appender.name}` if the appender name is available in the logging library.", |
| 87 | + "Otherwise, agents should also set `event.dataset=${service.name}.log`", |
| 88 | + "", |
| 89 | + "The field helps to filter for different log streams from the same pod, for example and is required for log anomaly detection." |
| 90 | + ] |
| 91 | + }, |
| 92 | + "process.thread.name": { |
| 93 | + "type": "string", |
| 94 | + "required": false, |
| 95 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-process.html" |
| 96 | + }, |
| 97 | + "log.logger": { |
| 98 | + "type": "string", |
| 99 | + "required": false, |
| 100 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-log.html" |
| 101 | + }, |
| 102 | + "log.origin.file.line": { |
| 103 | + "type": "integer", |
| 104 | + "required": false, |
| 105 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-log.html", |
| 106 | + "comment": "Should be opt-in as it requires the logging library to capture a stack trace for each log event." |
| 107 | + }, |
| 108 | + "log.origin.file.name": { |
| 109 | + "type": "string", |
| 110 | + "required": false, |
| 111 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-log.html", |
| 112 | + "comment": "Should be opt-in as it requires the logging library to capture a stack trace for each log event." |
| 113 | + }, |
| 114 | + "log.origin.function": { |
| 115 | + "type": "string", |
| 116 | + "required": false, |
| 117 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-log.html", |
| 118 | + "comment": "Should be opt-in as it requires the logging library to capture a stack trace for each log event." |
| 119 | + }, |
| 120 | + "error.type": { |
| 121 | + "type": "string", |
| 122 | + "required": false, |
| 123 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-error.html", |
| 124 | + "comment": "The exception type or class, such as `java.lang.IllegalArgumentException`." |
| 125 | + }, |
| 126 | + "error.message": { |
| 127 | + "type": "string", |
| 128 | + "required": false, |
| 129 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-error.html", |
| 130 | + "comment": "The message of the exception." |
| 131 | + }, |
| 132 | + "error.stack_trace": { |
| 133 | + "type": "string", |
| 134 | + "required": false, |
| 135 | + "url": "https://www.elastic.co/guide/en/ecs/current/ecs-error.html", |
| 136 | + "comment": "The stack trace of the exception as plain text." |
47 | 137 | }
|
48 |
| - } |
49 |
| - }, |
50 |
| - "trace.id": { |
51 |
| - "type": "string", |
52 |
| - "required": false, |
53 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-tracing.html", |
54 |
| - "comment": "When APM agents add this field to the context, ecs loggers should pick it up and add it to the log event." |
55 |
| - }, |
56 |
| - "transaction.id": { |
57 |
| - "type": "string", |
58 |
| - "required": false, |
59 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-tracing.html", |
60 |
| - "comment": "When APM agents add this field to the context, ecs loggers should pick it up and add it to the log event." |
61 |
| - }, |
62 |
| - "service.name": { |
63 |
| - "type": "string", |
64 |
| - "required": false, |
65 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-service.html", |
66 |
| - "comment": [ |
67 |
| - "Configurable by users.", |
68 |
| - "When an APM agent is active, they should auto-configure it if not already set." |
69 |
| - ] |
70 |
| - }, |
71 |
| - "event.dataset": { |
72 |
| - "type": "string", |
73 |
| - "required": false, |
74 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-event.html", |
75 |
| - "default": "${service.name}.log OR ${service.name}.${appender.name}", |
76 |
| - "comment": [ |
77 |
| - "Configurable by users.", |
78 |
| - "If the user manually configures the service name,", |
79 |
| - "the logging library should set `event.dataset=${service.name}.log` if not explicitly configured otherwise.", |
80 |
| - "", |
81 |
| - "When agents auto-configure the app to use an ECS logger,", |
82 |
| - "they should set `event.dataset=${service.name}.${appender.name}` if the appender name is available in the logging library.", |
83 |
| - "Otherwise, agents should also set `event.dataset=${service.name}.log`", |
84 |
| - "", |
85 |
| - "The field helps to filter for different log streams from the same pod, for example and is required for log anomaly detection." |
86 |
| - ] |
87 |
| - }, |
88 |
| - "process.thread.name": { |
89 |
| - "type": "string", |
90 |
| - "required": false, |
91 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-process.html" |
92 |
| - }, |
93 |
| - "log.logger": { |
94 |
| - "type": "string", |
95 |
| - "required": false, |
96 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-log.html" |
97 |
| - }, |
98 |
| - "log.origin.file.line": { |
99 |
| - "type": "integer", |
100 |
| - "required": false, |
101 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-log.html", |
102 |
| - "comment": "Should be opt-in as it requires the logging library to capture a stack trace for each log event." |
103 |
| - }, |
104 |
| - "log.origin.file.name": { |
105 |
| - "type": "string", |
106 |
| - "required": false, |
107 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-log.html", |
108 |
| - "comment": "Should be opt-in as it requires the logging library to capture a stack trace for each log event." |
109 |
| - }, |
110 |
| - "log.origin.function": { |
111 |
| - "type": "string", |
112 |
| - "required": false, |
113 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-log.html", |
114 |
| - "comment": "Should be opt-in as it requires the logging library to capture a stack trace for each log event." |
115 |
| - }, |
116 |
| - "error.type": { |
117 |
| - "type": "string", |
118 |
| - "required": false, |
119 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-error.html", |
120 |
| - "comment": "The exception type or class, such as `java.lang.IllegalArgumentException`." |
121 |
| - }, |
122 |
| - "error.message": { |
123 |
| - "type": "string", |
124 |
| - "required": false, |
125 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-error.html", |
126 |
| - "comment": "The message of the exception." |
127 |
| - }, |
128 |
| - "error.stack_trace": { |
129 |
| - "type": "string", |
130 |
| - "required": false, |
131 |
| - "url": "https://www.elastic.co/guide/en/ecs/current/ecs-error.html", |
132 |
| - "comment": "The stack trace of the exception as plain text." |
133 | 138 | }
|
134 |
| - } |
135 | 139 | }
|
0 commit comments