Showing `error.log` field in Observability Logs? (Currently it just shows `message` field, so it is very inconvenient to look at errors!)

[fzyzcjy]

Hi thanks for elastic stack! I wonder how can I show error.log field in Observability Logs? Currently it just shows message field, so it is very inconvenient to look at errors! When doing tail -f mylogfile, of course we can see the errors in addition to normal messages.

Thanks!

[Marius_Dragomir]

I've moved this to the Observability forum.

[weltenwort (Felix Stürmer)]

Hi @fzyzcjy,

you can add additional columns to the Logs UI in the settings. But I wonder: If you're seeing the error message in the log file, which step during the ingestion puts this into error.log instead of message? Are you using a filebeat module for shipping the logs?

[fzyzcjy]

Yes I can add additional columns. But that will make UI ugly... I just want the kind of "tail -f" experience.

I use ECS, and error stacktrace should be put into error.* fields instead of message.

[weltenwort (Felix Stürmer)]

You're correct. A related enhancement is being tracked in [Logs UI] Support error.stack_trace · Issue #46211 · elastic/kibana · GitHub. I'll bring it up again when planning the next versions. Feel free to add your voice to the linked issue.