Showing `error.log` field in Observability Logs? (Currently it just shows `message` field, so it is very inconvenient to look at errors!)

Elastic Observability Logs
#1

Hi thanks for elastic stack! I wonder how can I show error.log field in Observability Logs? Currently it just shows message field, so it is very inconvenient to look at errors! When doing tail -f mylogfile, of course we can see the errors in addition to normal messages.

Thanks!

#2

I've moved this to the Observability forum.

#3

Hi @fzyzcjy,

you can add additional columns to the Logs UI in the settings. But I wonder: If you're seeing the error message in the log file, which step during the ingestion puts this into error.log instead of message? Are you using a filebeat module for shipping the logs?

#4

Yes I can add additional columns. But that will make UI ugly... I just want the kind of "tail -f" experience.

I use ECS, and error stacktrace should be put into error.* fields instead of message.

#5

You're correct. A related enhancement is being tracked in [Logs UI] Support error.stack_trace · Issue #46211 · elastic/kibana · GitHub. I'll bring it up again when planning the next versions. Feel free to add your voice to the linked issue.