Best way of setting up `service.name` && any other fields that I should set up?

Elastic Observability Logs
1

Hi thanks for this product! I wonder how should I set up the service.name? What is the most recommended way to setup it for any kubernetes pod (e.g. a Spring java app, a Nginx, a Kafka...)

(Because I see here saying that, I should set up service.name in order to derive the event.dataset so as to see the logs categorized.)

Moreover, I wonder whether there are other fields that I should set up in order to make my life better besides this service.name?

Thanks very much!

2

Hi @fzyzcjy,

you should be able to perform quite a bit of correlation with service.name and event.dataset already. For k8s it might be useful to establish a convention in your environment to add the service name as a label to pods (e.g. app or service_name) and use the add_kubernetes_metadata and copy_field processors in the beats config to retrieve and copy it from kubernetes.label.app (or so) to service.name (and event.dataset in the logs case).

(btw, I wanted to clarify that event.dataset is not derived automatically, but the recommendation is to use the service name plus a type identifier (e.g. my_service.log).)

Does that make sense?

1 Like
3

Sounds great, Thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.