From https://x.com/jkuipers/status/1840849120874950716

GYwChGvXgAA7T3a

Comment From: philwebb

Several interesting ideas we could consider:

  • Should you be able to rename Logstash field names? I assumed they were standard, but it seems the Logstash appender allows renames.
  • Should we offer a quick way to include additional fields with static values? Service name is interesting because we do have a way to set that with ECS.
  • Should we offer a general MDC filtering mechanism?
  • Should we offer a general stacktrace post-processing mechanism?

Comment From: mp911de

You can draw some ideas from https://logging.paluch.biz/ that included stack trace filtering, dynamic MDC inclusion/exclusion and field name handling back from when that project has been active.

Comment From: philwebb

We discussed this today and we'd like to offer some enhancements if we can. I'm not sure how much we'll be able to get into 3.4 at this point. We might take stacktrace post-processing off the table for now.

Comment From: maxxedev

  • Renaming @ field like @timestamp to timestamp, for example, is tricky. The property needs to be:
logging.structured.json.rename[@timestamp]=timestamp

Consider documenting a tip

  • Is it possible to customize timestamp value? Can LOG_DATEFORMAT_PATTERN be applied there? Or change logstash default to match LOG_DATEFORMAT_PATTERN default of 3 digits sub-second precision?

Comment From: wilkinsona

Thanks for the suggestion, @maxxedev. Please open a new issue so that we can consider it.

Comment From: philwebb

Issue was opened as #42980