Add log.origin fields

CHANGELOG.next.md

@@ -10,6 +10,7 @@ Thanks, you're awesome :-) -->
 ### Bugfixes
 
 ### Added
+* Added `log.origin.file.name`, `log.origin.function` and `log.origin.file.line` fields. #563
 
 ### Improvements
 

docs/field-details.asciidoc

@@ -2098,6 +2098,39 @@ example: `org.elasticsearch.bootstrap.Bootstrap`
 
 // ===============================================================
 
+| log.origin.file.line
+| The line number of the file which originated the log event.
+
+type: integer
+
+example: `42`
+
+| core
+
+// ===============================================================
+
+| log.origin.file.name
+| The name of the source file which originated the log event.
+
+type: keyword
+
+example: `Bootstrap.java`
+
+| core
+
+// ===============================================================
+
+| log.origin.function
+| The name of the function or method which originated the log event.
+
+type: keyword
+
+example: `init`
+
+| core
+
+// ===============================================================
+
 | log.original
 | This is the original log message and contains the full log message before splitting it up in multiple parts.
 

generated/beats/fields.ecs.yml

@@ -1562,6 +1562,23 @@
       description: The name of the logger inside an application. This is usually the
         name of the class which initialized the logger, or can be a custom name.
       example: org.elasticsearch.bootstrap.Bootstrap
+    - name: origin.file.line
+      level: core
+      type: integer
+      description: The line number of the file which originated the log event.
+      example: 42
+    - name: origin.file.name
+      level: core
+      type: keyword
+      ignore_above: 1024
+      description: The name of the source file which originated the log event.
+      example: Bootstrap.java
+    - name: origin.function
+      level: core
+      type: keyword
+      ignore_above: 1024
+      description: The name of the function or method which originated the log event.
+      example: init
     - name: original
       level: core
       type: keyword

generated/csv/fields.csv

@@ -198,6 +198,9 @@ http.response.status_code,long,extended,404,1.2.0-dev
 http.version,keyword,extended,1.1,1.2.0-dev
 log.level,keyword,core,err,1.2.0-dev
 log.logger,keyword,core,org.elasticsearch.bootstrap.Bootstrap,1.2.0-dev
+log.origin.file.line,integer,core,42,1.2.0-dev
+log.origin.file.name,keyword,core,Bootstrap.java,1.2.0-dev
+log.origin.function,keyword,core,init,1.2.0-dev
 log.original,keyword,core,Sep 19 08:26:10 localhost My log,1.2.0-dev
 network.application,keyword,extended,aim,1.2.0-dev
 network.bytes,long,core,368,1.2.0-dev

generated/ecs/ecs_flat.yml

@@ -2216,6 +2216,35 @@ log.logger:
   order: 2
   short: Name of the logger.
   type: keyword
+log.origin.file.line:
+  description: The line number of the file which originated the log event.
+  example: 42
+  flat_name: log.origin.file.line
+  level: core
+  name: origin.file.line
+  order: 4
+  short: The line number of the file which originated the log event.
+  type: integer
+log.origin.file.name:
+  description: The name of the source file which originated the log event.
+  example: Bootstrap.java
+  flat_name: log.origin.file.name
+  ignore_above: 1024
+  level: core
+  name: origin.file.name
+  order: 3
+  short: The file which originated the log event.
+  type: keyword
+log.origin.function:
+  description: The name of the function or method which originated the log event.
+  example: init
+  flat_name: log.origin.function
+  ignore_above: 1024
+  level: core
+  name: origin.function
+  order: 5
+  short: The function which originated the log event.
+  type: keyword
 log.original:
   description: 'This is the original log message and contains the full log message
     before splitting it up in multiple parts.

generated/ecs/ecs_nested.yml

@@ -2521,6 +2521,35 @@ log:
       order: 2
       short: Name of the logger.
       type: keyword
+    origin.file.line:
+      description: The line number of the file which originated the log event.
+      example: 42
+      flat_name: log.origin.file.line
+      level: core
+      name: origin.file.line
+      order: 4
+      short: The line number of the file which originated the log event.
+      type: integer
+    origin.file.name:
+      description: The name of the source file which originated the log event.
+      example: Bootstrap.java
+      flat_name: log.origin.file.name
+      ignore_above: 1024
+      level: core
+      name: origin.file.name
+      order: 3
+      short: The file which originated the log event.
+      type: keyword
+    origin.function:
+      description: The name of the function or method which originated the log event.
+      example: init
+      flat_name: log.origin.function
+      ignore_above: 1024
+      level: core
+      name: origin.function
+      order: 5
+      short: The function which originated the log event.
+      type: keyword
     original:
       description: 'This is the original log message and contains the full log message
         before splitting it up in multiple parts.

generated/elasticsearch/6/template.json

@@ -940,6 +940,25 @@
               "ignore_above": 1024, 
               "type": "keyword"
             }, 
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "integer"
+                    }, 
+                    "name": {
+                      "ignore_above": 1024, 
+                      "type": "keyword"
+                    }
+                  }
+                }, 
+                "function": {
+                  "ignore_above": 1024, 
+                  "type": "keyword"
+                }
+              }
+            }, 
             "original": {
               "doc_values": false, 
               "ignore_above": 1024, 

generated/elasticsearch/7/template.json

@@ -939,6 +939,25 @@
             "ignore_above": 1024, 
             "type": "keyword"
           }, 
+          "origin": {
+            "properties": {
+              "file": {
+                "properties": {
+                  "line": {
+                    "type": "integer"
+                  }, 
+                  "name": {
+                    "ignore_above": 1024, 
+                    "type": "keyword"
+                  }
+                }
+              }, 
+              "function": {
+                "ignore_above": 1024, 
+                "type": "keyword"
+              }
+            }
+          }, 
           "original": {
             "doc_values": false, 
             "ignore_above": 1024, 

generated/legacy/template.json

@@ -638,6 +638,25 @@
               "ignore_above": 1024,
               "type": "keyword"
             },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
             "original": {
               "doc_values": false,
               "ignore_above": 1024,

schema.json

@@ -1525,6 +1525,36 @@
         "required": false, 
         "type": "keyword"
       }, 
+      "log.origin.file.line": {
+        "description": "The line number of the file which originated the log event.", 
+        "example": "42", 
+        "footnote": "", 
+        "group": 2, 
+        "level": "core", 
+        "name": "log.origin.file.line", 
+        "required": false, 
+        "type": "integer"
+      }, 
+      "log.origin.file.name": {
+        "description": "The name of the source file which originated the log event.", 
+        "example": "Bootstrap.java", 
+        "footnote": "", 
+        "group": 2, 
+        "level": "core", 
+        "name": "log.origin.file.name", 
+        "required": false, 
+        "type": "keyword"
+      }, 
+      "log.origin.function": {
+        "description": "The name of the function or method which originated the log event.", 
+        "example": "init", 
+        "footnote": "", 
+        "group": 2, 
+        "level": "core", 
+        "name": "log.origin.function", 
+        "required": false, 
+        "type": "keyword"
+      }, 
       "log.original": {
         "description": "This is the original log message and contains the full log message before splitting it up in multiple parts.\nIn contrast to the `message` field which can contain an extracted part of the log message, this field contains the original, full log message. It can have already some modifications applied like encoding or new lines removed to clean up the log message.\nThis field is not indexed and doc_values are disabled so it can't be queried but the value can be retrieved from `_source`.", 
         "example": "Sep 19 08:26:10 localhost My log", 

schemas/log.yml

@@ -43,3 +43,28 @@
       short: Name of the logger.
       description: >
         The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. 
+
+    - name: origin.file.name
+      level: core
+      type: keyword
+      example: Bootstrap.java
+      short: The file which originated the log event.
+      description: >
+        The name of the source file which originated the log event.
+
+    - name: origin.file.line
+      level: core
+      type: integer
+      example: 42
+      short: The line number of the file which originated the log event.
+      description: >
+        The line number of the file which originated the log event.
+
+    - name: origin.function
+      level: core
+      type: keyword
+      example: init
+      short: The function which originated the log event.
+      description: >
+        The name of the function or method which originated the log event.
+