Support content for body

[exejutable]

Is possible to add support for body content for request and response based on new spec?

Request body content

Response body content

When i try to add it manually the content is not sent, I assume it has something to do with the stringify serializer?

[rtritto]

Same problem. Body content is returned as {} instead of correct value.

Steps to reproduce

1. yarn init -y
2. yarn set version berry
3. yarn add @elastic/ecs-winston-format triple-beam winston
4. Create index.js file:

const winston = require('winston')
const ecsFormat = require('@elastic/ecs-winston-format')

const logger = winston.createLogger({
  level: 'info',
  format: ecsFormat(),
  transports: [
    new winston.transports.Console()
  ]
})

logger.info('test1', {
  http: {
    response: {
      body: {
        content: '{test:1}'
      }
    }
  }
})

5. yarn node index
6. Read log

Result

Actual

{
  "@timestamp": "2021-11-18T08:55:49.541Z",
  "log.level": "info",
  "message": "test1",
  "ecs": {
    "version": "1.6.0"
  },
  "http": {
    "response": {
      "body": {}
    }
  }
}

Expect

{
  "@timestamp": "2021-11-18T08:55:49.541Z",
  "log.level": "info",
  "message": "test1",
  "ecs": {
    "version": "1.6.0"
  },
  "http": {
    "response": {
      "body": "test1"
    }
  }
}

Workaround

...
logger.info('test1', {
  'http.response.body.content': "{test:1}"
})

Output:

{
  "@timestamp": "2021-11-18T08:55:49.541Z",
  "log.level": "info",
  "message": "test1",
  "ecs": {
    "version": "1.6.0"
  },
  "http.response.body.content": "{test:1}"
}

[rtritto]

My issue is related to format of @elastic/ecs-winston-format. winston correctly woks with another format.

[marcin-wlodarczyk]

The problem is in serializer.js:

const stringify = build({
  type: 'object',
  properties: {
    '@timestamp': string,
    'log.level': string,
    log: {
      type: 'object',
      properties: {
        logger: string
      }
    },
    message: string,
    ecs: {
      type: 'object',
      properties: {
        version: string
      }
    },
    // https://www.elastic.co/guide/en/ecs/current/ecs-event.html
    event: {
      type: 'object',
      properties: {
        dataset: string,
        id: string
      },
      additionalProperties: true
    },
    // https://www.elastic.co/guide/en/ecs/current/ecs-http.html
    http: {
      type: 'object',
      properties: {
        version: string,
        request: {
          type: 'object',
          properties: {
            method: string,
            headers: {
              type: 'object',
              additionalProperties: true
            },
            body: {
              type: 'object',
              properties: {
                bytes: number
              }
            }
          }
        },
        response: {
          type: 'object',
          properties: {
            status_code: number,
            headers: {
              type: 'object',
              additionalProperties: true
            },
            body: {
              type: 'object',
              properties: {
                bytes: number
              }
            }
          }
        }
      }
    },
    // https://www.elastic.co/guide/en/ecs/current/ecs-url.html
    url: {
      type: 'object',
      properties: {
        path: string,
        domain: string,
        port: number,
        query: string,
        fragment: string,
        full: string
      }
    },
    // https://www.elastic.co/guide/en/ecs/current/ecs-client.html
    client: {
      type: 'object',
      properties: {
        address: string,
        ip: string,
        port: number
      }
    },
    // https://www.elastic.co/guide/en/ecs/current/ecs-user_agent.html
    user_agent: {
      type: 'object',
      properties: {
        original: string
      }
    },
    // https://www.elastic.co/guide/en/ecs/current/ecs-tracing.html
    trace: {
      type: 'object',
      properties: {
        id: string
      }
    },
    transaction: {
      type: 'object',
      properties: {
        id: string
      }
    },
    span: {
      type: 'object',
      properties: {
        id: string
      }
    },
    // https://www.elastic.co/guide/en/ecs/current/ecs-service.html
    service: {
      type: 'object',
      properties: {
        name: string
      },
      additionalProperties: true
    },
    // https://www.elastic.co/guide/en/ecs/current/ecs-error.html
    error: {
      type: 'object',
      properties: {
        type: string,
        message: string,
        stack_trace: string
      },
      additionalProperties: true
    }
  },
  additionalProperties: true
})

Only bytes property is accepted.