ecs-dotnet icon indicating copy to clipboard operation
ecs-dotnet copied to clipboard

[BUG] Serialization of nested properties is broken

Open andreycha opened this issue 3 years ago • 0 comments

ECS integration/library project(s) (e.g. Elastic.CommonSchema.Serilog): Elastic.CommonSchema.Serilog

ECS schema version (e.g. 1.4.0): 8.3.1

ECS .NET assembly version (e.g. 1.4.2): main branch

Description of the problem, including expected versus actual behavior: Iran Serilog ASP.NET Core example in main branch and noticed that nested fields have wrong names after serialization, e.g. check http and user_agent fields in this example (document is reduced for brevity):

{
    "@timestamp": "2022-08-30T16:23:12.7722738+02:00",
    "log.level": "Information",
    "message": "Request finished HTTP/2 GET https://localhost:59987/weatherforecast - - - 200 - application/json;+charset=utf-8 423.9797ms",
    "ecs":
    {
        "version": "v8.3.1"
    },
    "http":
    {
        "request_method": "GET", // should be "request.method": "GET"
        "response_status_code": 200 // should be "response.status_code": "200"
    },
    "log":
    {
        "level": "Information",
        "logger": "Microsoft.AspNetCore.Hosting.Diagnostics"
    },
    "user_agent":
    {
        "os":
        {
            "family": "Windows",
            "full": "Windows 10",
            "version": "10"
        },
        "device_name": "Other", // should be "device.name": "Other"
        "name": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.102 Safari/537.36 OPR/90.0.4480.54",
        "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.102 Safari/537.36 OPR/90.0.4480.54",
        "version": "90.0.4480"
    }
}

PR https://github.com/elastic/ecs-dotnet/pull/194 has introduced new definition of ECS document where field names are defined using DataMember attribute. The problem is that it's not supported by System.Text.Json serializer. There is an own JsonPropertyName attribute for that purpose.

Tests in Elastic.CommonSchema.Tests.Serializes are not doing enough checks, e.g. field Name2 with overridden name here is not verified.

This is critical, since it affects all the .NET integrations and breaks log shipping.

Steps to reproduce:

  1. Run Serilog ASP.NET Core application
  2. Check console output

andreycha avatar Aug 30 '22 14:08 andreycha