Introduce log.file.path and friends

[roncohen]

Filebeat uses log.file.path to describe the file from which a log line was harvested. There’s no such ECS field. This describes source.path which also does not seem to exist in ECS. There’s file.path which probably is meant to mean that a specific log line contained a reference to a file, rather than that the log line was read from that file. Would be great to get log.file.path into ECS.

[webmat]

Agreed.

You're right that file.* at the top level is meant to capture details about files that are mentioned in the event itself.

log.* is mostly meant to capture metadata about the source of a log, so adding log.file.path for the source of a log event would make sense.

My first instinct would be to add this single field only, not nest all of file.* at log.file.*. Makes sense?

[roncohen]

I’m good with that. Thank you!

…

On Fri, 6 Mar 2020 at 21.49, Mathieu Martin ***@***.***> wrote: Agreed. You're right that file.* at the top level is meant to capture details about files that are mentioned in the event itself. log.* is mostly meant to capture metadata about the source of a log, so adding log.file.path for the source of a log event would make sense. My first instinct would be to add this single field only, not nest all of file.* at log.file.*. Makes sense? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#770?email_source=notifications&email_token=AAAAF2D3ZVTFIVTLLK3KE63RGFOUBA5CNFSM4LALV7AKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEOCZ3YQ#issuecomment-595959266>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAF2HNOHRF6TQHIVQLMATRGFOUBANCNFSM4LALV7AA> .

[webmat]

#802 👀