What is the equivalent in ECS fields reference of Trace.CorrelationManager.ActivityId?

Question

I'm working with a .NET framework application and for the logs i use NLog logging them on a ElasticSearch target using an ECS(Elastic Common Schema) layout. example:

One of the parameters i'm logging is the activityId:

It is well explained on this article.

Since i'm using an Nlog log layout, that tries to implement ECS 1.5 i'm wondering if anyone knows to which property activityId corresponds to? I think that event.id may make sense.

Answer 1

I think event.id is more like a Windows EventLog-EventId, that remains static independent of context. Where ActivityId is unique for each request.

Not sure where you have found NLog Layout of xsi:type="ElasticSearch". But when looking at EcsLayout here:

https://github.com/elastic/ecs-dotnet/tree/master/src/Elastic.CommonSchema.NLog

Then the these values are mapped:

• Transaction.Id = Identifier for the entire transaction. Ex. ${ElasticApmTransactionId}
• Trace.Id = CorrelationId for the current request. Ex. ${ElasticApmTraceId}
• Span.Id = ActivityId for an operation within a request.

See also: https://www.elastic.co/guide/en/ecs/current/ecs-tracing.html

I guess the field to choose depends on what value you have decided to store in Trace.CorrelationManager.ActivityId.

In the "new" world, then Microsoft is now selling System.Diagnostics.Activity.Current. See also: https://github.com/NLog/NLog.DiagnosticSource