# Observability field composition of Stream Logs message

**URL:** <https://discuss.elastic.co/t/observability-field-composition-of-stream-logs-message/378048>\
**Category:** Logs\
**Tags:** nodejs\
**Created:** [May 12, 2025, 2:39pm UTC](https://discuss.elastic.co/t/observability-field-composition-of-stream-logs-message/378048 "2025-05-12T14:39:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![b790718](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b790718/32/143042_2.png) [@b790718](https://discuss.elastic.co/u/b790718)\
**Post date:** [May 12, 2025, 2:39pm UTC](https://discuss.elastic.co/t/observability-field-composition-of-stream-logs-message/378048/1 "2025-05-12T14:39:52Z")

</div>

**Elasticsearch** : v8.11.0  
**Kibana** : v8.11.0  
**Filebeat** : v8.11.0  
**APM Agent** : nodejs v8.10.0

I use winston logger with ecs-winston-format.  
I am so confused about what field composition of Stream Message is ?  
When I set ecsFomat config \> convertReqRes : true, Stream Logs message first "" is always empty.  
I can't find the field composition of message in document

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/0/105c5387f0d7dedf31fc128579bb3517c2b50649.png)

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [May 12, 2025, 3:03pm UTC](https://discuss.elastic.co/t/observability-field-composition-of-stream-logs-message/378048/2 "2025-05-12T15:03:35Z")

</div>

Hi @b790718,

I agree this doesn't look perfect. What the UI attempts to do here is to interpolate the `event.dataset` field. This is part of the message reconstruction heuristics, which go astray sometimes.

If you're on a recent version of the Elastic Stack, you might want to try out Discover in a Kibana space configured for Observability: [Explore logs in Discover | Elastic Docs](https://www.elastic.co/docs/solutions/observability/logs/discover-logs)

Nowadays Discover adapts its rendering to suit the use-case better when the data viewed are log entries.