Skip to content

ECS format - Log event field order does not seem to comply with the ECS standard #260

@aduursma

Description

@aduursma

On the page below I read about the benefits of ECS logging:
https://www.elastic.co/guide/en/ecs-logging/overview/current/intro.html#_why_ecs_logging

Particularly:

Decently human-readable JSON structure

The first three fields are @timestamp, log.level and message. This lets you easily read the logs in a terminal without needing a tool that converts the logs to plain-text.

The above, however, does not seem to be the case.

For example, log.logger is the second field printed and the message field comes almost last.

Is there a way in which the order of the log event fields can be updated so at least the first three fields printed are @timestamp, log.level and message?

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions