opentelemetry-cpp icon indicating copy to clipboard operation
opentelemetry-cpp copied to clipboard

ElasticSearch Exporter does not follow ECS guidelines and logging reference

Open ShadowMaxLeb opened this issue 1 year ago • 3 comments

Describe your environment

Version 1.17.0 of this project.

Steps to reproduce Use the ElasticsearchLogRecordExporter

What is the expected behavior? The json sent should follow the ECS guidelines as much as possible as well as the ECS logging reference

What is the actual behavior? Some basic field needed by ELK are not there like @timestamp (timestamp today in the code)

General guidelines
The document MUST have the @timestamp field.
Use the [data types](https://www.elastic.co/guide/en/elasticsearch/reference/8.15/mapping-types.html) defined for an ECS field.
Use the ecs.version field to define which version of ECS is used.
Map as many fields as possible to ECS.

All attributes/resources are set under the attributes/resources key while I think they should be set at the root of the json or at least give a possibility to set attributes/resources at the root of the object so we can fill some fields like user.id

ShadowMaxLeb avatar Oct 11 '24 08:10 ShadowMaxLeb