This module adds a field to your logs that can be directly ingested by Elasticsearch without additional parsing. It appends an `elasticsearch_date` field to your log entries, making it easier to integrate with Elasticsearch ingestion pipelines.
Append a field to your logs that you can ingest directly into elasticsearch with no dissect or parsing magic
Usage:
In your services file you append it as a monolog processor. So for example if your service parameters look like this:
parameters:
monolog.channel_handlers:
default: ['file']
monolog.processors: ['message_placeholder', 'current_user', 'request_uri', 'ip', 'referer']
Change it to this:
parameters:
monolog.channel_handlers:
default: ['file']
monolog.processors: ['message_placeholder', 'current_user', 'request_uri', 'ip', 'referer', 'elasticsearch_date']
This will give you an additional field called extra.elasticsearch_date. If you are sending this field directly to elasticsearch from filebeat, you can use it like this (example):
processors:
- timestamp:
ignore_missing: true
ignore_failure: true
field: extra.elasticsearch_date
timezone: "Europe/Oslo"
layouts:
- '2006-01-02T15:04:05Z'
- '2020-06-02T13:20:50.516Z'
test:
- '2019-06-22T16:33:51Z'
- '2020-06-02T13:20:50.516Z'