Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] The fields event.code and event.action specificed by the ECS standard are not written correct in dotnet core #356

Open
HHobeck opened this issue Jan 19, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@HHobeck
Copy link

HHobeck commented Jan 19, 2024

ECS integration/library project(s) (e.g. Elastic.CommonSchema.Serilog):
I'm using the Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog (8.6.1) to output my logs in the ECS standard.

ECS schema version (e.g. 1.4.0):
The ecs.version is 8.6.0

ECS .NET assembly version (e.g. 1.4.2):
Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog (8.6.1)

Elasticsearch version (if applicable):
n/a

.NET framework / OS:
.net 6.0 on windows 10

Description of the problem, including expected versus actual behavior:
When I'm logging a message with an EventId the properties like EventId.Id and EventId.Name are written in a metadata field. I would expect that the event informataion are stored in the documented fields in the ECS standard (please see specification for Event Fields).

var logger = loggerFactory.CreateLogger(GetType());
logger.LogWarning(new EventId(123, "hello"), "Hello {World}", "Universe");

Actual log output:

{
    "metadata": {
        "EventId": {
            "Id": 123,
            "Name": "hello"
        }
    }
...
}

Expected log output:

{
    "event": {
        "code": 123,
        "action": "hello"
    }
...
}
@HHobeck HHobeck added the bug Something isn't working label Jan 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant