You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/reference/intro.md
+29-29Lines changed: 29 additions & 29 deletions
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ Centralized application logging with the Elastic stack made easy.
13
13
14
14
## What is ECS? [_what_is_ecs]
15
15
16
-
Elastic Common Schema (ECS) defines a common set of fields for ingesting data into Elasticsearch. For more information about ECS, visit the [ECS Reference Documentation](ecs://docs/reference/index.md).
16
+
Elastic Common Schema (ECS) defines a common set of fields for ingesting data into Elasticsearch. For more information about ECS, visit the [ECS Reference Documentation](ecs://reference/index.md).
17
17
18
18
19
19
## What is ECS logging? [_what_is_ecs_logging]
@@ -31,13 +31,13 @@ ECS loggers are plugins for your favorite logging library. They make it easy to
31
31
32
32
Refer to the installation instructions of the individual loggers:
@@ -66,19 +66,19 @@ We recommend shipping the logs with Filebeat. Depending on the way the applicati
66
66
Here are a few benefits to this over directly sending logs from the application to Elasticsearch:
67
67
68
68
**Resilient in case of outages**
69
-
: [Guaranteed at-least-once delivery](beats://docs/reference/filebeat/how-filebeat-works.md#at-least-once-delivery) without buffering within the application, thus no risk of out of memory errors or lost events. There’s also the option to use either the JSON logs or plain-text logs as a fallback.
69
+
: [Guaranteed at-least-once delivery](beats://reference/filebeat/how-filebeat-works.md#at-least-once-delivery) without buffering within the application, thus no risk of out of memory errors or lost events. There’s also the option to use either the JSON logs or plain-text logs as a fallback.
70
70
71
71
72
72
**Loose coupling**
73
-
: The application does not need to know the details of the logging backend (URI, credentials, etc.). You can also leverage alternative [Filebeat outputs](beats://docs/reference/filebeat/configuring-output.md), like Logstash, Kafka or Redis.
73
+
: The application does not need to know the details of the logging backend (URI, credentials, etc.). You can also leverage alternative [Filebeat outputs](beats://reference/filebeat/configuring-output.md), like Logstash, Kafka or Redis.
74
74
75
75
76
76
**Index Lifecycle management**
77
-
: Leverage Filebeat’s default [index lifecycle management settings](beats://docs/reference/filebeat/ilm.md). This is much more efficient than using daily indices.
77
+
: Leverage Filebeat’s default [index lifecycle management settings](beats://reference/filebeat/ilm.md). This is much more efficient than using daily indices.
@@ -91,17 +91,17 @@ These fields are populated by the ECS loggers by default. Some of them, such as
91
91
92
92
| ECS field | Description | Example |
93
93
| --- | --- | --- |
94
-
|[`@timestamp`](ecs://docs/reference/ecs-base.md)| The timestamp of the log event. |`"2019-08-06T12:09:12.375Z"`|
95
-
|[`log.level`](ecs://docs/reference/ecs-log.md)| The level or severity of the log event. |`"INFO"`|
96
-
|[`log.logger`](ecs://docs/reference/ecs-log.md)| The name of the logger inside an application. |`"org.example.MyClass"`|
97
-
|[`log.origin.file.name`](ecs://docs/reference/ecs-log.md)| The name of the file containing the source code which originated the log event. |`"App.java"`|
98
-
|[`log.origin.file.line`](ecs://docs/reference/ecs-log.md)| The line number of the file containing the source code which originated the log event. |`42`|
99
-
|[`log.origin.function`](ecs://docs/reference/ecs-log.md)| The name of the function or method which originated the log event. |`"methodName"`|
100
-
|[`message`](ecs://docs/reference/ecs-base.md)| The log message. |`"Hello World!"`|
101
-
|[`error.type`](ecs://docs/reference/ecs-error.md)| Only present for logs that contain an exception or error. The type or class of the error if this log event contains an exception. |`"java.lang.NullPointerException"`|
102
-
|[`error.message`](ecs://docs/reference/ecs-error.md)| Only present for logs that contain an exception or error. The message of the exception or error. |`"The argument cannot be null"`|
103
-
|[`error.stack_trace`](ecs://docs/reference/ecs-error.md)| Only present for logs that contain an exception or error. The full stack trace of the exception or error as a raw string. |`"Exception in thread "main" java.lang.NullPointerException\n\tat org.example.App.methodName(App.java:42)"`|
104
-
|[`process.thread.name`](ecs://docs/reference/ecs-process.md)| The name of the thread the event has been logged from. |`"main"`|
94
+
|[`@timestamp`](ecs://reference/ecs-base.md)| The timestamp of the log event. |`"2019-08-06T12:09:12.375Z"`|
95
+
|[`log.level`](ecs://reference/ecs-log.md)| The level or severity of the log event. |`"INFO"`|
96
+
|[`log.logger`](ecs://reference/ecs-log.md)| The name of the logger inside an application. |`"org.example.MyClass"`|
97
+
|[`log.origin.file.name`](ecs://reference/ecs-log.md)| The name of the file containing the source code which originated the log event. |`"App.java"`|
98
+
|[`log.origin.file.line`](ecs://reference/ecs-log.md)| The line number of the file containing the source code which originated the log event. |`42`|
99
+
|[`log.origin.function`](ecs://reference/ecs-log.md)| The name of the function or method which originated the log event. |`"methodName"`|
100
+
|[`message`](ecs://reference/ecs-base.md)| The log message. |`"Hello World!"`|
101
+
|[`error.type`](ecs://reference/ecs-error.md)| Only present for logs that contain an exception or error. The type or class of the error if this log event contains an exception. |`"java.lang.NullPointerException"`|
102
+
|[`error.message`](ecs://reference/ecs-error.md)| Only present for logs that contain an exception or error. The message of the exception or error. |`"The argument cannot be null"`|
103
+
|[`error.stack_trace`](ecs://reference/ecs-error.md)| Only present for logs that contain an exception or error. The full stack trace of the exception or error as a raw string. |`"Exception in thread "main" java.lang.NullPointerException\n\tat org.example.App.methodName(App.java:42)"`|
104
+
|[`process.thread.name`](ecs://reference/ecs-process.md)| The name of the thread the event has been logged from. |`"main"`|
105
105
106
106
107
107
### Configurable fields [_configurable_fields]
@@ -110,16 +110,16 @@ Refer to the documentation of the individual loggers on how to set these fields.
110
110
111
111
| ECS field | Description | Example |
112
112
| --- | --- | --- |
113
-
|[`service.name`](ecs://docs/reference/ecs-service.md)| Helps to filter the logs by service. |`"my-service"`|
114
-
|[`service.version`](ecs://docs/reference/ecs-service.md)| Helps to filter the logs by service version. |`"1.0"`|
115
-
|[`service.environment`](ecs://docs/reference/ecs-service.md)| Helps to filter the logs by environment. |`"production"`|
116
-
|[`service.node.name`](ecs://docs/reference/ecs-service.md)| Allow for two nodes of the same service, on the same host to be differentiated. |`"instance-0000000016"`|
117
-
|[`event.dataset`](ecs://docs/reference/ecs-event.md)| Enables the [log rate anomaly detection](docs-content://solutions/observability/logs/inspect-log-anomalies.md). |`"my-service"`|
113
+
|[`service.name`](ecs://reference/ecs-service.md)| Helps to filter the logs by service. |`"my-service"`|
114
+
|[`service.version`](ecs://reference/ecs-service.md)| Helps to filter the logs by service version. |`"1.0"`|
115
+
|[`service.environment`](ecs://reference/ecs-service.md)| Helps to filter the logs by environment. |`"production"`|
116
+
|[`service.node.name`](ecs://reference/ecs-service.md)| Allow for two nodes of the same service, on the same host to be differentiated. |`"instance-0000000016"`|
117
+
|[`event.dataset`](ecs://reference/ecs-event.md)| Enables the [log rate anomaly detection](docs-content://solutions/observability/logs/inspect-log-anomalies.md). |`"my-service"`|
118
118
119
119
120
120
### Custom fields [_custom_fields]
121
121
122
122
Most loggers allow you to add additional custom fields. This includes both, static and dynamic ones. Examples for dynamic fields are logging structured objects, or fields from a thread local context, such as `MDC` or `ThreadContext`.
123
123
124
-
When adding custom fields, we recommend using existing [ECS fields](ecs://docs/reference/ecs-field-reference.md) for these custom values. If there is no appropriate ECS field, consider prefixing your fields with `labels.`, as in `labels.foo`, for simple key/value pairs. For nested structures, consider prefixing with `custom.`. This approach protects against conflicts in case ECS later adds the same fields but with a different mapping.
124
+
When adding custom fields, we recommend using existing [ECS fields](ecs://reference/ecs-field-reference.md) for these custom values. If there is no appropriate ECS field, consider prefixing your fields with `labels.`, as in `labels.foo`, for simple key/value pairs. For nested structures, consider prefixing with `custom.`. This approach protects against conflicts in case ECS later adds the same fields but with a different mapping.
0 commit comments