ECS Logging Retrofit

I have audited the codebase and identified 14 logging statements. The application currently uses Winston with three different formats. I will convert these to @elastic/ecs-winston-format and provide a Docker-ready Filebeat configuration.

Log Audit and Proposal

Implementation: Winston ECS Formatter

const winston = require('winston');
const { ecsFormat } = require('@elastic/ecs-winston-format');

const logger = winston.createLogger({
  level: 'info',
  format: ecsFormat({ serviceName: process.env.SERVICE_NAME || 'auth-service' }),
  transports: [
    new winston.transports.Console()
  ]
});

// Example Rewrite:
// Old: logger.info("User " + user.id + " logged in");
logger.info("user logged in", { labels: { user_id: user.id }, event: { outcome: 'success', action: 'login' } });

Filebeat Configuration (filebeat.ecs.yml)

filebeat.inputs:
  - type: container
    id: auth-service-logs
    paths:
      - /var/lib/docker/containers/*/*.log
    parsers:
      - ndjson:
          target: ""
          overwrite_keys: true
          add_error_key: true

processors:
  - drop_event:
      when:
        equals:
          log.level: "debug"

output.elasticsearch:
  hosts: ["${ELASTIC_HOST}"]
  indices:
    - index: "logs-auth-service-%{+yyyy.MM.dd}"

setup.ilm.enabled: true

Next steps

1. Run npm install @elastic/ecs-winston-format to add the formatter.
2. Replace the Winston configuration in logger.js with the block above.
3. Deploy the Filebeat sidecar using the provided YAML.