[BUG] Logs not being parsed properly in Kibana APM app

LeaTaka commented 8 months ago

Microsoft.NET.Sdk.Web net6.0

Elastic.Apm.NLog Version=8.6.1 Elastic.CommonSchema.NLog Version=8.6.1 Elastic.Apm.NetCoreAll Version=1.25.2 Elastic.Apm.Extensions.Logging Version=1.25.2 NLog.Web.AspNetCore Version=5.* NLog Version=5.* NLog.Extensions.Logging Version=5.*

ECK: 2.10 Elasticsearch, Kibana, Fleet, Agents: 8.11.3

The problem: Application logs (_logger.LogInformation, etc..) are parsed correctly when Ilogger is used. The erroneous parsing is visible in the Kibana APM app on the Log tab of the Service ans also on the Log tab of a Trace when correlating logs to traces. I included screenshots of the the Log tab of the Services, in red the loglines that have Elastic .json documents attached in the included zipfile. I'm not sure if either the Kibana is the problem or one of the libraries I used.

Goal: Our goal is to use EcsLayout with Nlog and Ilogger

Reproduction: Please find a zipfile attached with the following examples for reproduction purposes; Ecs-Nlog-Iloggler.zip

app-10-dotnet application with Ilogger implementation
app-10-dotnet console logs example
app-10-dotnet screenshot of the behaviour in Kibana APM app on the log tab
app-10-dotnet Elasticsearch document (the line in red on the .png screenshot)
app-11-dotnet application without Ilogger implementation
app-11-dotnet console logs example
app-11-dotnet screenshot of the behaviour in Kibana APM app on the log tab
app-11-dotnet Elasticsearch document (the line in red on the .png screenshot)

Hope you can help solving this problem.

bart-medfar commented 7 months ago

I have the same issue when using serilog + elastic sink + apm on .net 8 web app

LeaTaka commented 7 months ago

Example pics attached of when configuring collumns in Kibana Logs ( not possible on the log tabs in the Kibana APM app )

1 add_msg_field_in_logs_settings 2 show_difference_between_Message_and_message_fields

Mpdreamz commented 7 months ago

Thanks for opening this issue @LeaTaka ultimately this is a bug/issue in kibana:

https://github.com/elastic/kibana/issues/176013

I tend to agree the special computed Message column should always prefer message over anything computed.

LeaTaka commented 3 months ago

Thanks for opening this issue @LeaTaka ultimately this is a bug/issue in kibana:

elastic/kibana#176013

I tend to agree the special computed Message column should always prefer message over anything computed.

Hi there Martijn, thanks for forwarding this to the Kibana team 👍 🌭

elastic / ecs-dotnet

[BUG] Logs not being parsed properly in Kibana APM app #354

app-10-dotnet Elasticsearch document (the line in red on the .png screenshot)