ecs-dotnet icon indicating copy to clipboard operation
ecs-dotnet copied to clipboard

[BUG] The fields event.code and event.action specificed by the ECS standard are not written correct in dotnet core

Open HHobeck opened this issue 1 year ago • 0 comments

ECS integration/library project(s) (e.g. Elastic.CommonSchema.Serilog): I'm using the Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog (8.6.1) to output my logs in the ECS standard.

ECS schema version (e.g. 1.4.0): The ecs.version is 8.6.0

ECS .NET assembly version (e.g. 1.4.2): Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog (8.6.1)

Elasticsearch version (if applicable): n/a

.NET framework / OS: .net 6.0 on windows 10

Description of the problem, including expected versus actual behavior: When I'm logging a message with an EventId the properties like EventId.Id and EventId.Name are written in a metadata field. I would expect that the event informataion are stored in the documented fields in the ECS standard (please see specification for Event Fields).

var logger = loggerFactory.CreateLogger(GetType());
logger.LogWarning(new EventId(123, "hello"), "Hello {World}", "Universe");

Actual log output:

{
    "metadata": {
        "EventId": {
            "Id": 123,
            "Name": "hello"
        }
    }
...
}

Expected log output:

{
    "event": {
        "code": 123,
        "action": "hello"
    }
...
}

HHobeck avatar Jan 19 '24 15:01 HHobeck