Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

V2: Allow easily filtering only the agent logs from the combined agent log file #1810

Closed
cmacknz opened this issue Nov 28, 2022 · 1 comment
Assignees
Labels
Team:Elastic-Agent Label for the Agent team v8.6.0

Comments

@cmacknz
Copy link
Member

cmacknz commented Nov 28, 2022

Comment originally made here #1702 (comment)

After #221 the spawned components contain message fields to easily allow separating them out when analyzing logs locally:

"component":{"binary":"metricbeat","dataset":"elastic_agent.http_metrics_monitoring","id":"http/metrics-monitoring","type":"http/metrics"},"log.origin":{"file.line":721,"file.name":"instance/beat.go"},"service.name":"metricbeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}

For example we have component":{"binary":"metricbeat","dataset":"elastic_agent.http_metrics_monitoring","id":"http/metrics-monitoring","type":"http/metrics"} and "service.name":"metricbeat" to allow looking at the monitoring metricbeat logs only.

We are missing these with logs coming from the agent itself:

{"log.level":"info","@timestamp":"2022-11-28T19:59:12.045Z","log.origin":{"file.name":"coordinator/coordinator.go","file.line":645},"message":"Updating running component model","ecs.version":"1.6.0"}

We should add at least "service.name":"agent" to allow filtering for agent specific logs easily e.g. being able to do rg '"service.name":"agent"' locally will save a lot of time during SDH analysis. The agent itself isn't a component so it makes sense for those fields to be missing.

@michalpristas
Copy link
Contributor

closing as #2044 went in

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Elastic-Agent Label for the Agent team v8.6.0
Projects
None yet
Development

No branches or pull requests

2 participants