we are currently migrating our NGINX logging format to the Elastic Common Schema. For some NGINX logging values I cannot find any fitting fields. In our case we use NGINX as a reverse proxy in Kubernetes. Most of the values we cannot match to ECS concern values about the upstream destination. Here are some examples where $value is the NGINX logging value:
- $upstream_status: Its the status code received from the upstream server. I guess in most cases this will be the same as http.response.status_code. However, we would like to give it a separate field. Intuitively I would use a custom field like destination.status for that.
- $upstream_response_time: It's the response time of the upstream server. Add this time to the time needed for NGINX to answer and you get event.duration. However, we would like to have this as a seperate field.
- $upstream_connect_time: It's the time taken to establish the connection to upstream server.
- $upstream_header_time: It's the time taken to receive the HTTP header of the upstream server's response.
Do I not see any matching fields? Are there plans to introduce new fields like this? How do you name custom fields when there is a fitting category like e.g. destination which we can use.