Add a service name to logs

Adding the service.name field to your logs associates them with the services that generate them. You can use this field to view and manage logs for distributed services located on multiple hosts.

To add a service name to your logs, either:

For log data without a service name, use the add_fields processor to add the service.name field. You can add the processor in an integration’s settings or in the Elastic Agent or Filebeat configuration.

For example, adding the add_fields processor to the inputs section of a standalone Elastic Agent or Filebeat configuration would add your_service_name as the service.name field:

processors:
    - add_fields:
        target: service
        fields:
            name: your_service_name

Adding the add_fields processor to an integration’s settings would add your_service_name as the service.name field:

For more on defining processors, refer to define processors.

For logs that with an existing field being used to represent the service name, map that field to the service.name field using the alias field type. Follow these steps to update your mapping:

For more ways to add a field to your mapping, refer to add a field to an existing mapping.

The Elastic Stack provides additional ways to process your data: