-
Notifications
You must be signed in to change notification settings - Fork 81
Open
Labels
agent-javacommunityIssues and PRs created by the communityIssues and PRs created by the communitytriageIssues and PRs that need to be triagedIssues and PRs that need to be triaged
Description
We just moved away from logstash
to now directly send the logs from our systems into elastic using filebeat.
As we used structured logging of logstash, we had to compensate that by using a custom Slf4jKeyValueEncoder
which maps the key/value pairs from slf4
to the AdditionalField supported by ECS encoder.
Something like that:
public final class Slf4jKeyValueEncoder extends EcsEncoder {
@Override
protected void addCustomFields(ILoggingEvent event, StringBuilder builder) {
requireNonNull(event, "A logging event is required");
var logEventAdditionalFields = convertKeyValuePairsToAdditionalFields(event.getKeyValuePairs());
EcsJsonSerializer.serializeAdditionalFields(builder, logEventAdditionalFields);
}
private List<AdditionalField> convertKeyValuePairsToAdditionalFields(List<KeyValuePair> keyValuePairs) {
if (keyValuePairs == null) {
return Collections.emptyList();
}
return keyValuePairs
.stream()
.map(it -> new AdditionalField(it.key, it.value.toString()))
.toList();
}
}
As we can see, AdditionalField
supports values of String
only.
The problem is that if we log something that is an Integer
or Long
, this ends up in Elastic like "1" or "1321654654". That prevents having fields in Elastic as numeric values.
Perhaps we could have value as an Object
and a switch statement, when writing to the StringBuilder
, to check if it's Number
or Boolean
and write it without the double quotes?
Metadata
Metadata
Assignees
Labels
agent-javacommunityIssues and PRs created by the communityIssues and PRs created by the communitytriageIssues and PRs that need to be triagedIssues and PRs that need to be triaged