Observability field composition of Stream Logs message

Elastic Observability Logs
1

Elasticsearch: v8.11.0
Kibana: v8.11.0
Filebeat: v8.11.0
APM Agent: nodejs v8.10.0

I use winston logger with ecs-winston-format.
I am so confused about what field composition of Stream Message is ?
When I set ecsFomat config > convertReqRes : true, Stream Logs message first "" is always empty.
I can't find the field composition of message in document

image
image907×472 30.1 KB

2

Hi @b790718,

I agree this doesn't look perfect. What the UI attempts to do here is to interpolate the event.dataset field. This is part of the message reconstruction heuristics, which go astray sometimes.

If you're on a recent version of the Elastic Stack, you might want to try out Discover in a Kibana space configured for Observability: Explore logs in Discover | Elastic Docs

Nowadays Discover adapts its rendering to suit the use-case better when the data viewed are log entries.

1 Like