Skip to content

Commit 6ebe370

Browse files
authored
Clean up advantages
1 parent abae4a2 commit 6ebe370

File tree

1 file changed

+13
-18
lines changed

1 file changed

+13
-18
lines changed

README.md

Lines changed: 13 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -24,33 +24,28 @@ Example:
2424

2525
## Why ECS logging?
2626

27-
Logging in ECS-compatible JSON has the advantage that you don't need to set up a logstash/ingest node pipeline to parse logs using grok.
28-
Another benefit is that you are automatically using the field names the
29-
[Logs UI](https://www.elastic.co/guide/en/kibana/7.3/xpack-logs.html) expects,
30-
which means that getting started with it is straightforward.
31-
32-
## APM Log correlation
33-
34-
If you are using the [Elastic APM Java agent](https://www.elastic.co/guide/en/apm/agent/java/current/index.html),
35-
you can leverage the [log correlation feature](https://www.elastic.co/guide/en/apm/agent/java/current/config-logging.html#config-enable-log-correlation) without any additional configuration.
36-
37-
This lets you jump from the [Span timeline in the APM UI](https://www.elastic.co/guide/en/kibana/master/spans.html) to the
38-
[Logs UI](https://www.elastic.co/guide/en/kibana/7.3/xpack-logs.html),
39-
showing only the logs which belong to the corresponding request.
40-
Vice versa, you can also jump from a log line in the Logs UI to the Span Timeline of the APM UI.
41-
42-
## Advantages
43-
27+
* No parsing of the log file required \
28+
Logging in ECS-compatible JSON has the advantage that you don't need to set up a logstash/ingest node pipeline to parse logs using grok.
4429
* No external dependencies
4530
* Highly efficient by manually serializing JSON
4631
* Low/Zero allocations (reduces GC pauses) \
4732
The log4j2 `EcsLayout` does not allocate any memory (unless the log event contains an `Exception`)
48-
* No parsing of the log file required
4933
* Decently human-readable JSON structure \
5034
The first three fields are always `@timestamp`, `log.level` and `message`.
5135
* Use the Kibana [Logs UI](https://www.elastic.co/guide/en/kibana/7.3/xpack-logs.html) without additional configuration \
5236
As this library adheres to [ECS](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html), the Logs UI knows which fields to show
5337
* Out-of-the-box correlation of logs and traces via the Logs UI and APM UI when using the [Elastic APM Java agent](https://www.elastic.co/guide/en/apm/agent/java/current/index.html)
38+
* Using a common schema across different services and teams makes it possible create reusable dashboards and avoids [mapping explosions](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html#mapping-limit-settings).
39+
40+
### APM Log correlation
41+
42+
If you are using the [Elastic APM Java agent](https://www.elastic.co/guide/en/apm/agent/java/current/index.html),
43+
you can leverage the [log correlation feature](https://www.elastic.co/guide/en/apm/agent/java/current/config-logging.html#config-enable-log-correlation) without any additional configuration.
44+
45+
This lets you jump from the [Span timeline in the APM UI](https://www.elastic.co/guide/en/kibana/master/spans.html) to the
46+
[Logs UI](https://www.elastic.co/guide/en/kibana/7.3/xpack-logs.html),
47+
showing only the logs which belong to the corresponding request.
48+
Vice versa, you can also jump from a log line in the Logs UI to the Span Timeline of the APM UI.
5449

5550
### Additional advantages when using in combination with Filebeat
5651

0 commit comments

Comments
 (0)