[BUG] The fields event.code and event.action specified by the ECS standard are not written correct in dotnet core

[HHobeck]

ECS integration/library project(s) (e.g. Elastic.CommonSchema.Serilog): I'm using the Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog (8.6.1) to output my logs in the ECS standard.

ECS schema version (e.g. 1.4.0): The ecs.version is 8.6.0

ECS .NET assembly version (e.g. 1.4.2): Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog (8.6.1)

Elasticsearch version (if applicable): n/a

.NET framework / OS: .net 6.0 on windows 10

Description of the problem, including expected versus actual behavior: When I'm logging a message with an EventId the properties like EventId.Id and EventId.Name are written in a metadata field. I would expect that the event information are stored in the documented fields in the ECS standard (please see specification for Event Fields).

var logger = loggerFactory.CreateLogger(GetType());
logger.LogWarning(new EventId(123, "hello"), "Hello {World}", "Universe");

Actual log output:

{
    "metadata": {
        "EventId": {
            "Id": 123,
            "Name": "hello"
        }
    }
...
}

Expected log output:

{
    "event": {
        "code": 123,
        "action": "hello"
    }
...
}

[Mpdreamz]

Just to be sure are you using https://github.com/serilog/serilog-extensions-logging ?

[Mpdreamz]

Just asking because vanilla extensions logging supports EventId https://github.com/elastic/ecs-dotnet/blob/746aa5c0e597c78b8f3eaeae184e157dddce1184/src/Elastic.Extensions.Logging/ElasticsearchLogger.cs#L182

Will add support for serilog/serilog-extensions-logging

[Mpdreamz]

Opened https://github.com/elastic/ecs-dotnet/pull/393 thanks for bringing this gap to our attention @HHobeck ! Sorry it took a bit for us to look into it.

[HHobeck]

Just to be sure are you using https://github.com/serilog/serilog-extensions-logging ?

Actually that is correct I'm using the following packages:

• Serilog.Extensions.Logging 8.0.0
• Serilog.Sinks.File 5.0.0

with the following configuration:

"Serilog": {
    "WriteTo:File": {
        "Name": "File",
        "Args": {
            "formatter": "Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog",
            "path": "./Logfiles/MyApplication-.log",
            "restrictedToMinimumLevel": "Verbose"
        }
    }
}

Thank you very much for taking the time.