in src/Elastic.CommonSchema.Serilog/LogEventConverter.cs [24:71]
public static TEcsDocument ConvertToEcs<TEcsDocument>(LogEvent logEvent, IEcsTextFormatterConfiguration<TEcsDocument> configuration, EcsDocumentCreationCache? initialCache = null)
where TEcsDocument : EcsDocument, new()
{
var ecsEvent = EcsDocument.CreateNewWithDefaults<TEcsDocument>(logEvent.Timestamp, logEvent.Exception, configuration, initialCache);
if (logEvent.TryGetScalarString(SpecialKeys.MachineName, out var machineName))
{
ecsEvent.Host ??= new Host();
ecsEvent.Host.Name = machineName;
}
// if we don't want to lookup up process through System.Diagnostics still include whatever information we get from
// serilog
if (!configuration.IncludeProcess)
ecsEvent.Process = GetProcessFromProperties(logEvent);
// prefer tracing information set by Elastic APM
if (TryGetTrace(logEvent, out var traceId)) ecsEvent.TraceId = traceId;
if (TryGetTransaction(logEvent, out var transactionId)) ecsEvent.TransactionId = transactionId;
if (TryGetSpan(logEvent, out var spanId)) ecsEvent.SpanId = spanId;
// prefer service information set by Elastic APM
var service = GetService(logEvent);
if (service != null) ecsEvent.Service = service;
// prefer our own user information, especially in web contexts this is richer
var user = GetUser(logEvent, configuration);
if (user != null) ecsEvent.User = user;
ecsEvent.Message = logEvent.RenderMessage(configuration.MessageFormatProvider);
ecsEvent.Log = GetLog(logEvent);
ecsEvent.Agent = GetAgent(logEvent) ?? DefaultAgent;
ecsEvent.Event = GetEvent(logEvent);
ecsEvent.Server = GetServer(logEvent, configuration);
ecsEvent.Http = GetHttp(logEvent, configuration);
ecsEvent.Url = GetUrl(logEvent, configuration);
ecsEvent.UserAgent = GetUserAgent(logEvent, configuration);
ecsEvent.Client = GetClient(logEvent, configuration);
var metaData = GetMetadata(logEvent, configuration.LogEventPropertiesToFilter);
foreach (var kv in metaData)
ecsEvent.AssignField(kv.Key, kv.Value);
if (configuration.MapCustom != null)
ecsEvent = configuration.MapCustom(ecsEvent, logEvent);
return ecsEvent;
}