-
Notifications
You must be signed in to change notification settings - Fork 80
Open
Labels
agent-javacommunityIssues and PRs created by the communityIssues and PRs created by the communitytriageIssues and PRs that need to be triagedIssues and PRs that need to be triaged
Description
We just moved away from logstash to now directly send the logs from our systems into elastic using filebeat.
As we used structured logging of logstash, we had to compensate that by using a custom Slf4jKeyValueEncoder which maps the key/value pairs from slf4 to the AdditionalField supported by ECS encoder.
Something like that:
public final class Slf4jKeyValueEncoder extends EcsEncoder {
@Override
protected void addCustomFields(ILoggingEvent event, StringBuilder builder) {
requireNonNull(event, "A logging event is required");
var logEventAdditionalFields = convertKeyValuePairsToAdditionalFields(event.getKeyValuePairs());
EcsJsonSerializer.serializeAdditionalFields(builder, logEventAdditionalFields);
}
private List<AdditionalField> convertKeyValuePairsToAdditionalFields(List<KeyValuePair> keyValuePairs) {
if (keyValuePairs == null) {
return Collections.emptyList();
}
return keyValuePairs
.stream()
.map(it -> new AdditionalField(it.key, it.value.toString()))
.toList();
}
}
As we can see, AdditionalField supports values of String only.
The problem is that if we log something that is an Integer or Long, this ends up in Elastic like "1" or "1321654654". That prevents having fields in Elastic as numeric values.
Perhaps we could have value as an Object and a switch statement, when writing to the StringBuilder, to check if it's Number or Boolean and write it without the double quotes?
Metadata
Metadata
Assignees
Labels
agent-javacommunityIssues and PRs created by the communityIssues and PRs created by the communitytriageIssues and PRs that need to be triagedIssues and PRs that need to be triaged