elastic / elastic/ecs-logging-java
Write SequenceNumber in jboss-logmanager-ecs-formatter
- Dominant language
- Java
- Stars
- 148
- Forks
- 82
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 3
Description
Hi,
because the "@timestamp" fields in ECS logging only support millisecond-precision, a sequence number is needed to keep the order of events. Adding this sequence number in FileBeat does not seem possible - only workarounds exist which include disabling multithreading (see https://discuss.elastic.co/t/sequence-number-for-ecs-events-received-by-tcp/291348 ).
Thus, the ECS formatter should add the sequence number ( https://www.elastic.co/guide/en/ecs/current/ecs-event.html#field-event-sequence ).
In case of the `co.elastic.logging.jboss.logmanager.EcsFormatter` this should be trivial as the `ExtLogRecord` from which the JSON is built already includes a method `getSequenceNumber`.
Adding the sequence number would solve a range of other issues regarding to log event order.
Contributor guide
Research direction
Start at co.elastic.logging.jboss.logmanager.EcsFormatter and trace how ExtLogRecord is converted to JSON. Check the ECS event.sequence field definition and the existing formatter test coverage, which the issue does not name. Done means the formatter output includes the record's sequence number in the ECS event structure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- observability-sre
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100