elastic / elastic/ecs-logging-java
Support numeric types on AdditionalField
- Vorherrschende Sprache
- Java
- Sterne
- 148
- Forks
- 82
- Ø Merge
- 2 T. 17 Std.
- Gemergte PRs (30 T.)
- 3
Beschreibung
We just moved away from `logstash` to now directly send the logs from our systems into elastic using filebeat.
As we used structured logging of logstash, we had to compensate that by using a custom `Slf4jKeyValueEncoder` which maps the key/value pairs from `slf4` to the AdditionalField supported by ECS encoder.
Something like that:
```
public final class Slf4jKeyValueEncoder extends EcsEncoder {
@Override
protected void addCustomFields(ILoggingEvent event, StringBuilder builder) {
requireNonNull(event, "A logging event is required");
var logEventAdditionalFields = convertKeyValuePairsToAdditionalFields(event.getKeyValuePairs());
EcsJsonSerializer.serializeAdditionalFields(builder, logEventAdditionalFields);
}
private List convertKeyValuePairsToAdditionalFields(List keyValuePairs) {
if (keyValuePairs == null) {
return Collections.emptyList();
}
return keyValuePairs
.stream()
.map(it -> new AdditionalField(it.key, it.value.toString()))
.toList();
}
}
```
As we can see, `AdditionalField` supports values of `String` only.
The problem is that if we log something that is an `Integer` or `Long`, this ends up in Elastic like "1" or "1321654654". That prevents having fields in Elastic as numeric values.
Perhaps we could have value as an `Object` and a switch statement, when writing to the `StringBuilder`, to check if it's `Number` or `Boolean` and write it without the double quotes?
Beitragsleitfaden
Rechercherichtung
Beginne damit, AdditionalField und EcsJsonSerializer zu finden, und verfolge dann, wie Werte zusätzlicher Felder in den StringBuilder geschrieben werden. Definiere den Abschluss dadurch, dass Zeichenketten in Anführungszeichen erhalten bleiben, während numerische und boolesche Werte als native JSON-Typen ausgegeben werden, und füge Tests für diese Wertarten hinzu oder aktualisiere sie, sofern das Projekt entsprechende Tests enthält.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- java
- Bereich
- observability-sre
- Issue-Typ
- Feature
- Schwierigkeit
- 3/5
- Geschätzter Aufwand
- 1-2 Tage
- Aktivitätsstatus
- Veraltet
- Klarheit
- Größtenteils klar
- Anfängerfreundlichkeit
- 45/100