elastic / elastic/ecs-logging-java

Write SequenceNumber in jboss-logmanager-ecs-formatter

Open
#154 0 comments 0 reactions 0 assignees View on GitHub
agent-java community triage
Dominant language
Java
Stars
148
Forks
82
Avg merge
2d 17h
Merged PRs (30d)
3

Description

Hi,

because the "@timestamp" fields in ECS logging only support millisecond-precision, a sequence number is needed to keep the order of events. Adding this sequence number in FileBeat does not seem possible - only workarounds exist which include disabling multithreading (see https://discuss.elastic.co/t/sequence-number-for-ecs-events-received-by-tcp/291348 ).

Thus, the ECS formatter should add the sequence number ( https://www.elastic.co/guide/en/ecs/current/ecs-event.html#field-event-sequence ).

In case of the `co.elastic.logging.jboss.logmanager.EcsFormatter` this should be trivial as the `ExtLogRecord` from which the JSON is built already includes a method `getSequenceNumber`.

Adding the sequence number would solve a range of other issues regarding to log event order.

Contributor guide

Open the contributing guide

Research direction

Start at co.elastic.logging.jboss.logmanager.EcsFormatter and trace how ExtLogRecord is converted to JSON. Check the ECS event.sequence field definition and the existing formatter test coverage, which the issue does not name. Done means the formatter output includes the record's sequence number in the ECS event structure.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
observability-sre
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.