Add marker information to ECS structured logging

[lauroschuck]

Marker information is not included in the output JSON when using ECS format (Spring Boot 3.4.1).

Sample logger code:

var marker = MarkerFactory.getDetachedMarker("foo");
marker.add(MarkerFactory.getDetachedMarker("bar"));
log.info(marker, "Hello world");

ECS format output (no foo/bar):

{"@timestamp":"2025-01-08T10:01:24.864634875Z","log.level":"INFO","process.pid":460866,"process.thread.name":"main","service.name":"my-service","log.logger":"my.service.MyClass","message":"Hello world","ecs.version":"8.11"}

It would be expected for the flattened array of markers to be present in the tags field (ECS reference), arguably the most adequate place for such data, also according to other implementations:

• Boot's Logstash format output:

{"@timestamp":"2025-01-08T10:13:59.081878833+01:00","@version":"1","message":"Hello world","logger_name":"my.service.MyClass","thread_name":"main","level":"INFO","level_value":20000,"tags":["foo","bar"]}

• Logback ECS encoder from Elastic's lib (co.elastic.logging:logback-ecs-encoder:1.6.0) with includeMarkers=true:

{"@timestamp":"2025-01-08T10:05:46.777Z","log.level": "INFO","message":"Hello world","ecs.version": "1.2.0","tags":["foo","bar"],"service.name":"my-service","process.thread.name":"main","log.logger":"my.service.MyClass"}

[philwebb]

It looks like the following code deals with this in the ECS logging library:

https://github.com/elastic/ecs-logging-java/blob/9bc228bbb38efdfa8803338b9b8ce4715c96b51b/logback-ecs-encoder/src/main/java/co/elastic/logging/logback/EcsEncoder.java#L161-L178

[mhalbritter]

Superseded in favor of #43768.