Get startededit

Step 1: Installedit

Add the package to your go.mod file:

require go.elastic.co/ecslogrus master

Step 2: Configureedit

Set up a default logger. For example:

log := logrus.New()
log.SetFormatter(&ecslogrus.Formatter{})

Examplesedit

Use structured loggingedit

// Add custom fields.
log.WithError(errors.New("boom!")).WithField("custom", "foo").Info("hello")

The example above produces the following log output:

{
  "@timestamp": "2021-01-20T11:12:43.061+0800",
  "custom":"foo",
  "ecs.version": "1.6.0",
  "error": {
    "message": "boom!"
  },
  "log.level": "info",
  "message":"hello"
}

Nest custom fields under "labels"edit

For complete ECS compliance, custom fields should be nested in a "labels" object.

log := logrus.New()
log.SetFormatter(&ecslogrus.Formatter{
    DataKey: "labels",
})
log.WithError(errors.New("boom!")).WithField("custom", "foo").Info("hello")

The example above produces the following log output:

{
  "@timestamp": "2021-01-20T11:12:43.061+0800",
  "ecs.version": "1.6.0",
  "error": {
    "message": "boom!"
  },
  "labels": {
    "custom": "foo"
  },
  "log.level": "info",
  "message":"hello"
}

Report caller informationedit

log := logrus.New()
log.SetFormatter(&ecslogrus.Formatter{})
log.ReportCaller = true
log.Info("hello")

The example above produces the following log output:

{
  "@timestamp": "2021-01-20T11:12:43.061+0800",
  "ecs.version": "1.6.0",
  "log.level": "info",
  "log.origin.file.line": 48,
  "log.origin.file.name": "/path/to/example_test.go",
  "log.origin.function": "go.elastic.co/ecslogrus_test.ExampleFoo",
  "message":"hello"
}

Step 3: Configure Filebeatedit

  1. Follow the Filebeat quick start
  2. Add the following configuration to your filebeat.yaml file.

For Filebeat 7.16+

filebeat.yaml.

filebeat.inputs:
- type: filestream
  paths: /path/to/logs.json
  parsers:
    - ndjson:
        keys_under_root: true
        overwrite_keys: true
        add_error_key: true
        expand_keys: true

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

For Filebeat < 7.16

filebeat.yaml.

filebeat.inputs:
- type: log
  paths: /path/to/logs.json
  json.keys_under_root: true
  json.overwrite_keys: true
  json.add_error_key: true
  json.expand_keys: true

processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~

For more information, see the Filebeat reference.