spring-projects / spring-projects/spring-boot

ECS structured logging logs some ECS fields with incorrect types

Open
#49,270 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: team-only type: enhancement
Dominant language
Java
Stars
81.5k
Forks
42.7k
Avg merge
2d 4h
Merged PRs (30d)
65

Description

Hey,

we're using Spring Boot 4.0.2 with structured logging in ECS format enabled:

logging:
  structured:
    format:
      console: ecs
      file: ecs

According to ECS's documentation, there are fields that should not be a String, e. g. url.port. Problem is, this and probably others are logged as String as can be seen here.

I understand that this is not easy solvable as all MDC fields are String, but this violates the ECS standard and produces lots of problems when ingested in an Elastic cluster without transformation.
It'd probably best if the logger checked ECS field types and only logged them if they were convertible to the type required by the spec.

We're currently solving this by using special transformations in the spring-logback.xml which also doesn't feel good.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with the shown logging.structured.format configuration and inspect the structured logging ECS implementation and the spring-logback.xml workaround described in the report. Done means the relevant ECS fields are emitted with types accepted by the ECS specification, with coverage for the affected fields.

Written by the indexing model from the issue text.

Assessment

Tech stack
elasticsearch, java, spring-boot
Domain
observability
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.