ecs-dotnet
ecs-dotnet copied to clipboard
[BUG] The fields event.code and event.action specificed by the ECS standard are not written correct in dotnet core
ECS integration/library project(s) (e.g. Elastic.CommonSchema.Serilog): I'm using the Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog (8.6.1) to output my logs in the ECS standard.
ECS schema version (e.g. 1.4.0): The ecs.version is 8.6.0
ECS .NET assembly version (e.g. 1.4.2): Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog (8.6.1)
Elasticsearch version (if applicable): n/a
.NET framework / OS: .net 6.0 on windows 10
Description of the problem, including expected versus actual behavior: When I'm logging a message with an EventId the properties like EventId.Id and EventId.Name are written in a metadata field. I would expect that the event informataion are stored in the documented fields in the ECS standard (please see specification for Event Fields).
var logger = loggerFactory.CreateLogger(GetType());
logger.LogWarning(new EventId(123, "hello"), "Hello {World}", "Universe");
Actual log output:
{
"metadata": {
"EventId": {
"Id": 123,
"Name": "hello"
}
}
...
}
Expected log output:
{
"event": {
"code": 123,
"action": "hello"
}
...
}