elastic / elastic/ecs

Using ECS to track the source of errors or exceptions

Open
#154 21 comments 1 reaction 0 assignees View on GitHub
discuss
Dominant language
Python
Stars
1.1k
Forks
455
Avg merge
17h 8m
Merged PRs (30d)
5

Description

I'd like to discuss the use case of tracking the source of program errors / exceptions (line numbers, function names, etc) with ECS. These fields may end up under the field sets `file` and/or `error`.

I'd like to get feedback on how we could approach this. Information we may like to track about where the error was raised:

* error source file
* line number
* error message
* function/method name
* class / module (or other structure) inside which that function/method lives, when appropriate
* error class / standardized name (e.g. literally the class name in an OO language)
* error fields, if any
* error stack trace

Please let me know if there's anything I'm missing in terms of relevant data to support.

Here's a suggestion of a mapping for the above:

* error source file: [file.path](https://github.com/elastic/ecs#user-content-file.path)
* `error.line` (`long`)
* `error.message` (`text`)
* `error.function` (`keyword`)
* the word function is a bit more broad than `method`, IMO, so can serve both use cases.
* Error class: [error.id](https://github.com/elastic/ecs#user-content-error.id)
* Error fields
* Either create a field similar to [labels](https://github.com/elastic/ecs#user-content-labels), where people nest their kv attributes or we don't add it to ECS at first.
* stack trace: `error.stack_trace` (non indexed)

* @graphaelli or @roncohen I'd like your POV on how you're doing it currently in APM
* @ruflin I'd like your opinion on this as well

Contributor guide

Open the contributing guide

Research direction

Start with the existing file.path and error.id definitions linked in the issue, then read the 21-comment discussion for any agreed direction. Done would require a settled ECS mapping for the proposed error-source fields and a documented decision on fields such as nested error attributes and stack traces.

Written by the indexing model from the issue text.

Assessment

Domain
observability-sre
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.