IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Plaintext logs with Filebeat APM agent ECS reformatting with Filebeat »
Elastic Docs ›Observability Guide [8.6] ›Application logs

ECS logging with Filebeat

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ECS logging with Filebeat

edit

Elastic Common Schema (ECS) loggers format your logs into ECS-compatible JSON, removing the need to manually parse logs.

Requirements

  • (Optional) Elastic APM agent for your programming language (for log correlation)
  • The Elastic ECS logger for your language or framework
  • Filebeat configured to monitor and capture application logs

Pros

  • Popular logging frameworks supported
  • Simplicity: no manual parsing with Filebeat, and a configuration can be reused across applications
  • Decently human-readable JSON structure
  • APM log correlation
  • Resilient in case of outages

Cons

  • Not all frameworks are supported
  • Requires modification of the application and its log configuration

Get started

edit

See the guide for your favorite logging framework:

« Plaintext logs with Filebeat APM agent ECS reformatting with Filebeat »