ECS Logging Go (Zerolog)

https://www.elastic.co/guide/en/ecs-logging/go-zerolog/current/
Admin
ECS Logging Go (Zerolog) is a formatter plugin for the Zerolog logging library that formats Go...
Tokens:827
Snippets:13
Trust Score:10
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install ECS Zerolog package

Source: https://www.elastic.co/guide/en/ecs-logging/go-zerolog/current/setup.html

Add the required dependency to your go.mod file.

```text
require go.elastic.co/ecszerolog main
		
```

--------------------------------

### Log output example

Source: https://www.elastic.co/guide/en/ecs-logging/go-zerolog/current/setup.html

The resulting JSON output from the structured logging example.

```json
{
  "@timestamp": "2021-01-20T11:12:43.061+0800",
  "custom":"foo",
  "ecs.version": "1.6.0",
  "log.level": "info",
  "message":"hello world"
}
		
```

--------------------------------

### Use structured logging

Source: https://www.elastic.co/guide/en/ecs-logging/go-zerolog/current/setup.html

Example of adding custom fields to a log message.

```go
// Add custom fields.
log.Info().Msg("hello world").Str("custom", "foo")
		
```

--------------------------------

### Default ECS log output format

Source: https://www.elastic.co/guide/en/ecs-logging/go-zerolog/current/intro.html

Example of the JSON structure produced by the ECS logger, including standard fields like log level, timestamp, message, and ECS version.

```json
{
  "log.level": "info",
  "@timestamp": "2020-09-13T10:48:03.000Z",
  "message":" some logging info",
  "ecs.version": "1.6.0"
}
```

--------------------------------

### Configure Zerolog logger

Source: https://www.elastic.co/guide/en/ecs-logging/go-zerolog/current/setup.html

Initialize the ECS Zerolog logger and set it as the global logger.

```go
logger := ecszerolog.New(os.Stdout)
log.Logger = logger
		
```

--------------------------------

### Configure Filebeat 7.16+

Source: https://www.elastic.co/guide/en/ecs-logging/go-zerolog/current/setup.html

Configuration for Filebeat 7.16 and later using the filestream input.

```yaml
filebeat.inputs:
- type: filestream
  paths: /path/to/logs.json
  parsers:
    - ndjson:
      overwrite_keys: true
      add_error_key: true
      expand_keys: true

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~
		
```

--------------------------------

### Configure Filebeat before 7.16

Source: https://www.elastic.co/guide/en/ecs-logging/go-zerolog/current/setup.html

Configuration for Filebeat versions older than 7.16 using the log input.

```yaml
filebeat.inputs:
- type: log
  paths: /path/to/logs.json
  json.keys_under_root: true
  json.overwrite_keys: true
  json.add_error_key: true
  json.expand_keys: true

processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~
		
```

--------------------------------

### Configure Kubernetes pod annotations

Source: https://www.elastic.co/guide/en/ecs-logging/go-zerolog/current/setup.html

Annotations to add to Kubernetes pods for proper log parsing.

```yaml
annotations:
  co.elastic.logs/json.overwrite_keys: true
  co.elastic.logs/json.add_error_key: true
  co.elastic.logs/json.expand_keys: true
		
```

--------------------------------

### Configure Docker container labels

Source: https://www.elastic.co/guide/en/ecs-logging/go-zerolog/current/setup.html

Labels to add to Docker containers for proper log parsing.

```yaml
labels:
  co.elastic.logs/json.overwrite_keys: true
  co.elastic.logs/json.add_error_key: true
  co.elastic.logs/json.expand_keys: true
		
```
Tokens:
Raw