Add logs intake fields to app_logs data stream

elastic · Nov 24, 2022 · 34e4ff8 · 34e4ff8
1 parent 13875ce
commit 34e4ff8
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 0 deletions.
diff --git a/apmpackage/apm/changelog.yml b/apmpackage/apm/changelog.yml
@@ -20,6 +20,9 @@
     - description: Remove `timeseries.instance` field
       type: enhancement
       link: https://github.com/elastic/apm-server/pull/9565
+    - description: Add fields to app_logs data stream: error.stack_trace, event.dataset, log.logger, log.origin.*, process.thread.name
+      type: enhancement
+      link: https://github.com/elastic/apm-server/pull/TODO
 - version: "8.5.0"
   changes:
     - description: Add package settings to enable the experimental collection of service metrics

diff --git a/apmpackage/apm/data_stream/app_logs/fields/ecs.yml b/apmpackage/apm/data_stream/app_logs/fields/ecs.yml
@@ -72,6 +72,10 @@
   name: device.manufacturer
 - external: ecs
   name: ecs.version
+- external: ecs
+  name: error.stack_trace
+- external: ecs
+  name: event.dataset
 - external: ecs
   name: event.outcome
 - external: ecs
@@ -110,6 +114,14 @@
   dynamic: true
 - external: ecs
   name: log.level
+- external: ecs
+  name: log.logger
+- external: ecs
+  name: log.origin.file.line
+- external: ecs
+  name: log.origin.file.name
+- external: ecs
+  name: log.origin.function
 - external: ecs
   name: message
 - external: ecs
@@ -126,6 +138,8 @@
   name: process.pid
 - external: ecs
   name: process.parent.pid
+- external: ecs
+  name: process.thread.name
 - external: ecs
   name: process.title
 - external: ecs