RENDER_ECS

Render a LogEvent into JSON in Elastic Common Schema for sending directly to an ELK stack.

It populates ECS fields as follows:

  • timestamp ->@timestamp

  • host ->host.name

  • logger ->log.logger

  • level ->log.level

  • message (evaluated template) ->message

  • If stackTrace is present:

  • stackTrace ->error.stack_trace

  • message (evaluated template) ->error.message

  • context (if present) ->context in labels object

  • items (if present) ->items (object)