log.level isn't mapped or populated for error messages

[marclop]

APM Server version (apm-server version): All

Description of the problem including expected versus actual behavior:

APM Errors don't currently include log.level when documents are indexed in Elasticsearch. This makes these documents awkward to consume and filter as a user since the logs cannot be included in searches where log.level:error.

Steps to reproduce:

1. Capture an error event in an instrumented APM Application.
2. Inspect the document and you'll see that log.level is used

Provide logs (if relevant):

[rubvs]

Will is be possible to provide some screenshots please? I don't see any logs provided in the description.

[smith]

@rubvs Here's some APM error logs:

They contain error.log.level and error.log.message instead of the ECS log.level and message.

[shevkaboss]

Having the same issue!
Waiting for reply, for now my workaround is to have ingest pipeline for that, which also works a bit weird (not adding log level on Stream view).

Waiting for reply

[rubvs]

@shevkaboss and @smith we are already working on a fix and intend to include it in an upcoming minor version release.

[shevkaboss]

@rubvs thanks for quick reply.

Just wondering, is that possible also to show error level on Stream view?
For traces, system Message field will be like "[dataSet.platform] [log.level] message". I would love to see that as "[error] message".

[smith]

@shevkaboss we're going to be making some updates to the log stream view soon that might help you with this. Can you set Logs Explorer up to show this how you want?

[simitt]

@marclop are you actively working on this?

[marclop]

Missed the ping. This was fixed in elastic/apm-data#362.