Populate event.dataset based on service.name

[tobiasstadler]

ecs-logging-java does a similar thing

[ghost]

❕ Build Aborted

The PR is not allowed to run in the CI yet

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-02-14T19:43:18.209+0000

• Duration: 0 min 27 sec

Steps errors

Expand to view the steps failures

Load a resource file from a library

• Took 0 min 0 sec . View more details here
• Description: approval-list/elastic/ecs-logging-php.yml

Error signal

• Took 0 min 0 sec . View more details here
• Description: githubApiCall: The REST API call https://api.github.com/orgs/elastic/members/tobiasstadler return the message : java.lang.Exception: httpRequest: Failure connecting to the service https://api.github.com/orgs/elastic/members/tobiasstadler : httpRequest: Failure connecting to the service https://api.github.com/orgs/elastic/members/tobiasstadler : Code: 404Error: {"message":"User does not exist or is not a member of the organization","documentation_url":"https://docs.github.com/rest/reference/orgs#check-organization-membership-for-a-user"}

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[pimjansen]

This is weird imo? You log it to the service space right? Why push it to the event in that case

[tobiasstadler]

By default Logs app in Kibana displays the event.dataset field (see https://www.elastic.co/guide/en/kibana/current/observability.html#logs-app), so I think it is valuable to have support for it in the php Ed’s logging implementation. The Java implementation populates the field based on the service name, if not explicitly given (see https://github.com/elastic/ecs-logging-java/blob/09c07cf451bebb86f82e3f21abc0579455d81ee8/ecs-logging-core/src/main/java/co/elastic/logging/EcsJsonSerializer.java#L283) so I thought we should do the same here.

Do you think creating a Event class is better?