search

quarkiverse / quarkus-logging-json

Quarkus logging extension outputting the logging in json.
Apache License 2.0
62 stars 29 forks source link

ECS format - Log event field order does not seem to comply with the ECS standard #260

Open aduursma opened 1 year ago

aduursma commented 1 year ago

On the page below I read about the benefits of ECS logging: https://www.elastic.co/guide/en/ecs-logging/overview/current/intro.html#_why_ecs_logging

Particularly:

Decently human-readable JSON structure

The first three fields are @timestamp, log.level and message. This lets you easily read the logs in a terminal without needing a tool that converts the logs to plain-text.

The above, however, does not seem to be the case.

For example, log.logger is the second field printed and the message field comes almost last.

Is there a way in which the order of the log event fields can be updated so at least the first three fields printed are @timestamp, log.level and message?

SlyngDK commented 1 year ago

I was not aware of this recommendation. I think it is just about changing the order of the fields here https://github.com/quarkiverse/quarkus-logging-json/blob/817895573b93a6df5ff9f18e1560c45fa4393847/runtime/src/main/java/io/quarkiverse/loggingjson/LoggingJsonRecorder.java#L106

You are welcome to create a PR, with the change.