JSON-logging compliant with ECS-format

[johkin]

Is your feature request related to a problem? Please describe.

We are ingesting our RabbitMQ-logs as json into an ELK-installation, but according to the ECS-rules (or perhaps Elasticsearch) we are having trouble to parse the produced json.
The object "mfa" is an array with mixed contents with both String and Integer/Long.

Describe the solution you'd like

We would either like to see the mfa-object as a String-array or even better if one could specify to use the ECS standard in the generated json logs?

Describe alternatives you've considered

There are other tools that can modify the logs once they are produced, but it would easier to produce schema-compliant logs to start with.

Additional context

No response

[johkin]

An example snippet of the logs:
"mfa": ["ra_server_sup_sup", "delete_server_rpc", 2]

[ansd]

FWIW, #2927 (comment) describes the different configuration options what fields to emit in the JSON log. You should be able to omit field mfa (module function arguments) completely (if that's acceptable for you).

[johkin]

Thanks, that could be a good starting point! I'll look into it!

[michaelklishin]

@johkin we will not guess what specifically is logged in your case. Please provide a complete JSON example.

Given that #2927 exists and seeks to address the same fundamental problem, I'm moving this to a discussion.