spring-projects / spring-projects/spring-boot
ECS structured logging logs some ECS fields with incorrect types
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 81.5k
- Forks
- 42.7k
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 65
Description
Hey,
we're using Spring Boot 4.0.2 with structured logging in ECS format enabled:
logging:
structured:
format:
console: ecs
file: ecs
According to ECS's documentation, there are fields that should not be a String, e. g. url.port. Problem is, this and probably others are logged as String as can be seen here.
I understand that this is not easy solvable as all MDC fields are String, but this violates the ECS standard and produces lots of problems when ingested in an Elastic cluster without transformation.
It'd probably best if the logger checked ECS field types and only logged them if they were convertible to the type required by the spec.
We're currently solving this by using special transformations in the spring-logback.xml which also doesn't feel good.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with the shown logging.structured.format configuration and inspect the structured logging ECS implementation and the spring-logback.xml workaround described in the report. Done means the relevant ECS fields are emitted with types accepted by the ECS specification, with coverage for the affected fields.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elasticsearch, java, spring-boot
- Domain
- observability
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100