Duplicate JSON property in output if loglevel is configured for ECS format

[gyszalai]

We try to use pino for logging in ECS format. ECS defines a toplevel property called log that embraces level, logger and other properties, like this:

{ "log": { "level": "info", "logger": "myLogger" } }

To be compatible with ECS, I configured the logger like this:

I have the following code:

'use strict'
const pino = require('pino')
const ECS_VERSION = '1.7.0'

const logger = pino({
  messageKey: 'message',
  timestamp: () => `,"@timestamp":"${new Date().toISOString()}"`,
  mixin() {
    return { ecs: { version: ECS_VERSION } }
  },
  level: 'info',
  formatters: {
    level(label, number) {
      return { log: { level: label } }
    },
    bindings(bindings) {
      return { process: { pid: bindings.pid }, host: { hostname: bindings.hostname } }
    }
  }
})

If I call the logger with a simple string, everything seems to be OK:

logger.info('test')

output:

{
    "log": { "level": "info" },
    "@timestamp": "2020-11-23T11:42:57.982Z", 
    "process": { "pid": 10838 }, 
    "host": { "hostname": "myhost" }, 
    "ecs": { "version": "1.7.0" },
    "message": "test"
}

But if I try to log an object that contains a log property, it is duplicated in the output:

logger.info({ log: { logger: 'myLogger' } }, 'this is the message')

output:

{
    "log": { "level": "info" },
    "@timestamp": "2020-11-23T11:42:57.982Z", 
    "process": { "pid": 10838 }, 
    "host": { "hostname": "myhost" }, 
    "ecs": { "version": "1.7.0" },
    "log": { "logger": "myLogger" }, 
    "message": "this is the message"
}

[jsumners]

This is likely due to the fact that we do not de-duplicate properties -- https://github.com/pinojs/pino/blob/3a78dbc8fa29dac1ad242b9d564abb9399c055bd/docs/child-loggers.md#duplicate-keys-caveat

[gyszalai]

Oh, I see. But this time it's not about child loggers. I have only one logger that I would like be ECS compatible. Is there any way I can solve this problem?

[jsumners]

I'm not clear if that is the issue, but I suspect it is. Someone will have to do some investigation.

[mcollina]

@delvedor given this is really about ElasticSearch and ECS, could you please check this out?

[delvedor]

Hello! You can use @elastic/ecs-pino-format that will format to ECS automatically for you :)

const ecsFormat = require('@elastic/ecs-pino-format')()
const pino = require('pino')({ ...ecsFormat })

[Fdawgs]

@gyszalai Did you manage to resolve this?

[github-actions[bot]]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.