Better way to customize the JSON layout keys

[kemingy]

I'm planning to migrate from tracing log to logforth. One thing that blocks me now is the keys in the JSON format. E.g., logforth uses the

logforth/layouts/json/src/lib.rs

Lines 88 to 101 in 41a327b

	#[derive(Debug, Clone, Serialize)]
	struct RecordLine<'a> {
	#[serde(serialize_with = "serialize_timestamp")]
	timestamp: TimestampDisplayWithOffset,
	level: &'a str,
	target: &'a str,
	file: &'a str,
	line: u32,
	message: &'a str,
	#[serde(skip_serializing_if = "Map::is_empty")]
	kvs: Map<String, serde_json::Value>,
	#[serde(skip_serializing_if = "Map::is_empty")]
	diags: Map<String, serde_json::Value>,
	}

So the additional fields will be placed in the kvs. While tracing is using fields. (BTW, tracing places the message inside the fields)

This won't be something very important. But I hope the migration won't affect the users if they already have some log parser rules.

I wonder if there are some easy ways to customize the keys in the JSON layout, instead of re-implementing a new JSON layout.

[tisonkun]

This sounds like a new feature. Do you care about kvs only? Or perhaps also diags?

Perhaps we can enable a customizable kvs/diags rename option and change the serde logic. Or simply add an option to switch between kvs and fields as only for smooth migration from tracing.

[kemingy]

I'm not using the diags, but that should be included as well.

kvs/diags rename option sounds like a good idea. Switching kvs/fields also works for me, but it's a bit too specific. Depends on your decision.

[tisonkun]

Can you show case how tracing formats the fields? I'm reading their code But it seems they put everything inside fields?

If this is such a specific behavior, perhaps a new layout is more desirable than patching the existing JsonLayout.

[kemingy]

More details can be found here: mosecorg/mosec#665

Agree, maybe a tracing JSON format is more desirable.