Field for http response times

Elastic Observability Logs
1

Hey,

Our app logs HTTP response times for the APIs we provide. What would be the best standard field to put this data in to follow ECS standard and best practices? There is no http.response.latency or similar field and event.* fields look like an overkill.

Thank you.

1 Like
2

For the current ECS spec I would say event.duration with start and end are the most applicable fields to use.

1 Like
3

Welcome to the community, @Sergii_Ovcharenko!

I agree with @legoguy1000 that event.duration could map well to something like $request_time from NGINX (noting the necessary value conversion from milliseconds to nanoseconds).

If event.duration doesn't align with your need, custom fields can be used alongside ECS fields, and if you follow the recommended guidance you minimize the risk of any future field name conflicts.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.