Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Elasticsearch 8 should emit structured logs with ECS 8 #82490

Closed
yaauie opened this issue Jan 12, 2022 · 2 comments
Closed

Elasticsearch 8 should emit structured logs with ECS 8 #82490

yaauie opened this issue Jan 12, 2022 · 2 comments
Labels
:Core/Infra/Logging Log management and logging utilities >enhancement Team:Core/Infra Meta label for core/infra team

Comments

@yaauie
Copy link
Member

yaauie commented Jan 12, 2022

ECS 8 is set to be released along-side Elastic Stack 8. I would expect to see an 8.x version in the structured logs emitted by Elasticsearch 8 snapshots, but I am still seeing "ecs.version": "1.2.0":

{"@timestamp":"2022-01-11T22:02:37.530Z", "log.level": "INFO", "message":"version[8.1.0-SNAPSHOT], pid[9], build[default/docker/0ca3db6d66a483f6377ca6eb4d0142c895cf693d/2022-01-10T16:05:39.811971724Z], OS[Linux/5.11.0-1023-gcp/amd64], JVM[Eclipse Adoptium/OpenJDK 64-Bit Server VM/17.0.1/17.0.1+12]", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"main","log.logger":"org.elasticsearch.node.Node","elasticsearch.node.name":"25ec142c5879","elasticsearch.cluster.name":"docker-cluster"}

I suspect this is because Elasticsearch relies on elastic/ecs-logging-java, which hard-codes 1.2.0 in its latest release. The scope of changes from 1.last to 8.0 is small, and is gathered in elastic/ecs#839

@yaauie yaauie added >enhancement :Core/Infra/Logging Log management and logging utilities needs:triage Requires assignment of a team area label labels Jan 12, 2022
@elasticmachine elasticmachine added the Team:Core/Infra Meta label for core/infra team label Jan 12, 2022
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-core-infra (Team:Core/Infra)

@not-napoleon not-napoleon removed the needs:triage Requires assignment of a team area label label Jan 13, 2022
@pgomulka pgomulka self-assigned this May 11, 2022
@rdnm rdnm removed the team-discuss label Jun 8, 2022
@pgomulka
Copy link
Contributor

@yaauie as you mentioned. We rely on ecs-logging-java which is using 1.2.0 as ecs.version. The reason is that the ecs-logging-java do not use fields added after 1.2.0, so should only indicated the "minimum version supported"
see the discussion on this here elastic/ecs-logging#44
I will close the issue for now

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
:Core/Infra/Logging Log management and logging utilities >enhancement Team:Core/Infra Meta label for core/infra team
Projects
None yet
Development

No branches or pull requests

5 participants