in src/Elastic.CommonSchema.NLog/EcsLayout.cs [570:606]
private Process GetProcess(LogEventInfo logEventInfo)
{
var processId = ProcessId?.Render(logEventInfo);
var processName = ProcessName?.Render(logEventInfo);
var processTitle = ProcessTitle?.Render(logEventInfo);
var processExecutable = ProcessExecutable?.Render(logEventInfo);
var processThreadId = ProcessThreadId?.Render(logEventInfo);
var processThreadName = ProcessThreadName?.Render(logEventInfo);
var previousProcess = _previousProcess;
if (string.IsNullOrEmpty(processThreadId) && string.IsNullOrEmpty(processThreadName))
{
// Only attempt to reuse Process-object when not including Thread-details
if ((string.IsNullOrEmpty(processTitle) || processTitle == previousProcess?.Title)
&& (string.IsNullOrEmpty(processName) || processName == previousProcess?.Name)
&& (string.IsNullOrEmpty(processId) || long.Parse(processId) == previousProcess?.Pid)
&& (string.IsNullOrEmpty(processExecutable) || processExecutable == previousProcess?.Executable))
return previousProcess;
}
var process = new Process
{
Title = string.IsNullOrEmpty(processTitle) ? previousProcess?.Title : processTitle,
Name = string.IsNullOrEmpty(processName) ? previousProcess?.Name : processName,
Executable = string.IsNullOrEmpty(processExecutable) ? previousProcess?.Executable : processExecutable,
Pid = string.IsNullOrEmpty(processId) ? previousProcess?.Pid : long.Parse(processId),
ThreadId = string.IsNullOrEmpty(processThreadId) ? null : long.Parse(processThreadId),
ThreadName = string.IsNullOrEmpty(processThreadName) ? null : processThreadName,
};
if (!process.ThreadId.HasValue && string.IsNullOrEmpty(process.ThreadName))
{
_previousProcess = process;
}
return process;
}