Skip to content

Support numeric types on AdditionalField #319

@robsonhermes

Description

@robsonhermes

We just moved away from logstash to now directly send the logs from our systems into elastic using filebeat.
As we used structured logging of logstash, we had to compensate that by using a custom Slf4jKeyValueEncoder which maps the key/value pairs from slf4 to the AdditionalField supported by ECS encoder.

Something like that:

public final class Slf4jKeyValueEncoder extends EcsEncoder {

    @Override
    protected void addCustomFields(ILoggingEvent event, StringBuilder builder) {
        requireNonNull(event, "A logging event is required");
        var logEventAdditionalFields = convertKeyValuePairsToAdditionalFields(event.getKeyValuePairs());
        EcsJsonSerializer.serializeAdditionalFields(builder, logEventAdditionalFields);
    }

    private List<AdditionalField> convertKeyValuePairsToAdditionalFields(List<KeyValuePair> keyValuePairs) {
        if (keyValuePairs == null) {
            return Collections.emptyList();
        }

        return keyValuePairs
                .stream()
                .map(it -> new AdditionalField(it.key, it.value.toString()))
                .toList();
    }
}

As we can see, AdditionalField supports values of String only.
The problem is that if we log something that is an Integer or Long, this ends up in Elastic like "1" or "1321654654". That prevents having fields in Elastic as numeric values.

Perhaps we could have value as an Object and a switch statement, when writing to the StringBuilder, to check if it's Number or Boolean and write it without the double quotes?

Metadata

Metadata

Assignees

No one assigned

    Labels

    agent-javacommunityIssues and PRs created by the communitytriageIssues and PRs that need to be triaged

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions