Open
Conversation
…pport
Parse `otel` mappings from the ECS 9.x YAML spec, generate bidirectional
mapping tables (ECS <-> OTel), and support reading/writing OTel attributes
alongside standard ECS fields.
ECS fields are always serialized as ECS fields. OTel semantic convention
attributes are stored in the `Attributes` passthrough dictionary and
serialized under an `attributes` object.
## Setting OTel attributes
Use `SemConv` constants with `AssignOTelField` to set an OTel attribute
that is stored in `Attributes` and simultaneously mapped to its ECS
property:
```csharp
var doc = new EcsDocument();
doc.AssignOTelField(SemConv.ExceptionMessage, "connection refused");
// doc.Error.Message == "connection refused"
// doc.Attributes["exception.message"] == "connection refused"
```
Or set attributes directly on the dictionary:
```csharp
var doc = new EcsDocument
{
Message = "Request completed",
Attributes = new MetadataDictionary
{
[SemConv.ExceptionMessage] = "connection refused",
["custom.field"] = "custom value",
}
};
```
## Serialization
The standard serializer writes ECS fields as ECS fields and the
`Attributes` dictionary as the `attributes` object:
```csharp
var json = doc.Serialize();
// {
// "@timestamp": "...",
// "message": "Request completed",
// "ecs.version": "...",
// "attributes": {
// "exception.message": "connection refused",
// "custom.field": "custom value"
// }
// }
```
## Reading OTel format
`EcsDocument.Deserialize()` handles JSON that includes an `attributes`
object. OTel attribute names are automatically mapped to their ECS
equivalents:
```csharp
var json = """{"attributes":{"exception.message":"timeout"}}""";
var doc = EcsDocument.Deserialize(json);
// doc.Error.Message == "timeout"
// doc.Attributes["exception.message"] == "timeout"
```
## OTEL_RESOURCE_ATTRIBUTES integration
`CreateNewWithDefaults` processes `OTEL_RESOURCE_ATTRIBUTES` entries
through the mapping table. Equivalent mappings (e.g.
`deployment.environment.name`) set both the ECS field and `Attributes`.
Unknown attributes are stored in `Attributes` only.
…assthrough Labels and Metadata are now [Obsolete] and route to Attributes. Serialization merges all three into a single "attributes" JSON key (Attributes wins over Metadata wins over Labels). Deserialization reads "labels", "metadata", and "attributes" JSON keys all into the Attributes property. The ES base component now includes an "attributes" passthrough mapping.
🤖 GitHub commentsJust comment with:
|
Elasticsearch 9 requires a non-negative priority on passthrough-type mappings. The ECS 9.3.0 base component template defined attributes as passthrough without a priority, causing a mapper_parsing_exception when bootstrapping the ecs_9.3.0_base component template. Fix the generator to inject priority: 10 when reading passthrough-type component mappings that lack one, and regenerate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
otelmappings from the ECS 9.x YAML spec, generate bidirectional mapping tables, and exposeAssignOTelField,SemConvconstants, andOTelMappingsdictionaries. OTel attributes are stored in anAttributespassthrough dictionary and serialized under anattributesobject alongside standard ECS fields.LabelsandMetadatainto the singleAttributespassthrough. Both properties are now[Obsolete]; serialization merges all three into a single"attributes"JSON key (Attributeswins overMetadatawins overLabels). Deserialization reads"labels","metadata", and"attributes"JSON keys all intoAttributes. The ES base component gains anattributes: passthroughmapping.OTEL support
Parse
otelmappings from the ECS 9.x YAML spec, generate bidirectionalmapping tables (ECS <-> OTel), and support reading/writing OTel attributes
alongside standard ECS fields.
ECS fields are always serialized as ECS fields. OTel semantic convention
attributes are stored in the
Attributespassthrough dictionary andserialized under an
attributesobject.Setting OTel attributes
Use
SemConvconstants withAssignOTelFieldto set an OTel attributethat is stored in
Attributesand simultaneously mapped to its ECSproperty:
Or set attributes directly on the dictionary:
Serialization
The standard serializer writes ECS fields as ECS fields and the
Attributesdictionary as theattributesobject:Reading OTel format
EcsDocument.Deserialize()handles JSON that includes anattributesobject. OTel attribute names are automatically mapped to their ECS
equivalents:
OTEL_RESOURCE_ATTRIBUTES integration
CreateNewWithDefaultsprocessesOTEL_RESOURCE_ATTRIBUTESentriesthrough the mapping table. Equivalent mappings (e.g.
deployment.environment.name) set both the ECS field andAttributes.Unknown attributes are stored in
Attributesonly.