elastic / elastic/ecs-logging-java

Support numeric types on AdditionalField

Open
#319 0 comments 1 reaction 0 assignees View on GitHub
agent-java community triage
Dominant language
Java
Stars
148
Forks
82
Avg merge
2d 17h
Merged PRs (30d)
3

Description

We just moved away from `logstash` to now directly send the logs from our systems into elastic using filebeat.
As we used structured logging of logstash, we had to compensate that by using a custom `Slf4jKeyValueEncoder` which maps the key/value pairs from `slf4` to the AdditionalField supported by ECS encoder.

Something like that:

```
public final class Slf4jKeyValueEncoder extends EcsEncoder {

@Override
protected void addCustomFields(ILoggingEvent event, StringBuilder builder) {
requireNonNull(event, "A logging event is required");
var logEventAdditionalFields = convertKeyValuePairsToAdditionalFields(event.getKeyValuePairs());
EcsJsonSerializer.serializeAdditionalFields(builder, logEventAdditionalFields);
}

private List convertKeyValuePairsToAdditionalFields(List keyValuePairs) {
if (keyValuePairs == null) {
return Collections.emptyList();
}

return keyValuePairs
.stream()
.map(it -> new AdditionalField(it.key, it.value.toString()))
.toList();
}
}
```
As we can see, `AdditionalField` supports values of `String` only.
The problem is that if we log something that is an `Integer` or `Long`, this ends up in Elastic like "1" or "1321654654". That prevents having fields in Elastic as numeric values.

Perhaps we could have value as an `Object` and a switch statement, when writing to the `StringBuilder`, to check if it's `Number` or `Boolean` and write it without the double quotes?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.