Add more ECS fields to logs

libbeat/logp/config.go

@@ -80,3 +80,14 @@ func DefaultConfig(environment Environment) Config {
 		addCaller:   true,
 	}
 }
+
+// LogFilename returns the base filename to which logs will be written for
+// the "files" log output. If another log output is used, or `logging.files.name`
+// is unspecified, then the beat name will be returned.
+func (cfg Config) LogFilename() string {
+	name := cfg.Beat
+	if cfg.Files.Name != "" {
+		name = cfg.Files.Name
+	}
+	return name
+}

libbeat/logp/core.go

@@ -196,6 +196,13 @@ func makeOptions(cfg Config) []zap.Option {
 	if cfg.development {
 		options = append(options, zap.Development())
 	}
+	if cfg.ECSEnabled {
+		fields := []zap.Field{
+			zap.String("service.name", cfg.Beat),
+			zap.String("event.dataset", cfg.LogFilename()),
+		}
+		options = append(options, zap.Fields(fields...))
+	}
 	return options
 }
 
@@ -226,11 +233,7 @@ func makeEventLogOutput(cfg Config) (zapcore.Core, error) {
 }
 
 func makeFileOutput(cfg Config) (zapcore.Core, error) {
-	name := cfg.Beat
-	if cfg.Files.Name != "" {
-		name = cfg.Files.Name
-	}
-	filename := paths.Resolve(paths.Logs, filepath.Join(cfg.Files.Path, name))
+	filename := paths.Resolve(paths.Logs, filepath.Join(cfg.Files.Path, cfg.LogFilename()))
 
 	rotator, err := file.NewFileRotator(filename,
 		file.MaxSizeBytes(cfg.Files.MaxSize),

libbeat/logp/core_test.go

@@ -146,3 +146,30 @@ func TestNotDebugAllStdoutDisablesDefaultGoLogger(t *testing.T) {
 	DevelopmentSetup(WithSelectors("other"), WithLevel(InfoLevel))
 	assert.Equal(t, ioutil.Discard, golog.Writer())
 }
+
+func TestLoggingECSFields(t *testing.T) {
+	cfg := Config{
+		Beat:        "beat1",
+		Level:       DebugLevel,
+		development: true,
+		ECSEnabled:  true,
+		Files: FileConfig{
+			Name: "beat1.log",
+		},
+	}
+	ToObserverOutput()(&cfg)
+	Configure(cfg)
+
+	logger := NewLogger("tester")
+
+	logger.Debug("debug")
+	logs := ObserverLogs().TakeAll()
+	if assert.Len(t, logs, 1) {
+		if assert.Len(t, logs[0].Context, 2) {
+			assert.Equal(t, "service.name", logs[0].Context[0].Key)
+			assert.Equal(t, "beat1", logs[0].Context[0].String)
+			assert.Equal(t, "event.dataset", logs[0].Context[1].Key)
+			assert.Equal(t, "beat1.log", logs[0].Context[1].String)
+		}
+	}
+}