1

I'm working with a .NET framework application and for the logs i use NLog logging them on a ElasticSearch target using an ECS(Elastic Common Schema) layout. example: enter image description here

One of the parameters i'm logging is the activityId: enter image description here

It is well explained on this article.

Since i'm using an Nlog log layout, that tries to implement ECS 1.5 i'm wondering if anyone knows to which property activityId corresponds to? I think that event.id may make sense.

Nmaster88
  • 1,405
  • 2
  • 23
  • 65

1 Answers1

1

I think event.id is more like a Windows EventLog-EventId, that remains static independent of context. Where ActivityId is unique for each request.

Not sure where you have found NLog Layout of xsi:type="ElasticSearch". But when looking at EcsLayout here:

https://github.com/elastic/ecs-dotnet/tree/master/src/Elastic.CommonSchema.NLog

Then the these values are mapped:

  • Transaction.Id = Identifier for the entire transaction. Ex. ${ElasticApmTransactionId}
  • Trace.Id = CorrelationId for the current request. Ex. ${ElasticApmTraceId}
  • Span.Id = ActivityId for an operation within a request.

See also: https://www.elastic.co/guide/en/ecs/current/ecs-tracing.html

I guess the field to choose depends on what value you have decided to store in Trace.CorrelationManager.ActivityId.

In the "new" world, then Microsoft is now selling System.Diagnostics.Activity.Current. See also: https://github.com/NLog/NLog.DiagnosticSource

Rolf Kristensen
  • 17,785
  • 1
  • 51
  • 70