---
title: Get started with ECS Logging Go (Logrus)
description: Add the package to your go.mod file: Set up a default logger. For example: The example above produces the following log output: For complete ECS compliance,...
url: https://www.elastic.co/elastic/docs-builder/docs/3028/reference/ecs/logging/go-logrus/setup
products:
  - ECS Logging
  - ECS Logging Go (Logrus)
---

# Get started with ECS Logging Go (Logrus)
## Step 1: Install

Add the package to your `go.mod` file:
```go
require go.elastic.co/ecslogrus master
```


## Step 2: Configure

Set up a default logger. For example:
```go
log := logrus.New()
log.SetFormatter(&ecslogrus.Formatter{})
```


## Examples


### Use structured logging

```go
// Add custom fields.
log.WithError(errors.New("boom!")).WithField("custom", "foo").Info("hello")
```

The example above produces the following log output:
```json
{
  "@timestamp": "2021-01-20T11:12:43.061+0800",
  "custom":"foo",
  "ecs.version": "1.6.0",
  "error": {
    "message": "boom!"
  },
  "log.level": "info",
  "message":"hello"
}
```


### Nest custom fields under "labels"

For complete ECS compliance, custom fields should be nested in a "labels" object.
```go
log := logrus.New()
log.SetFormatter(&ecslogrus.Formatter{
    DataKey: "labels",
})
log.WithError(errors.New("boom!")).WithField("custom", "foo").Info("hello")
```

The example above produces the following log output:
```json
{
  "@timestamp": "2021-01-20T11:12:43.061+0800",
  "ecs.version": "1.6.0",
  "error": {
    "message": "boom!"
  },
  "labels": {
    "custom": "foo"
  },
  "log.level": "info",
  "message":"hello"
}
```


### Report caller information

```go
log := logrus.New()
log.SetFormatter(&ecslogrus.Formatter{})
log.ReportCaller = true
log.Info("hello")
```

The example above produces the following log output:
```json
{
  "@timestamp": "2021-01-20T11:12:43.061+0800",
  "ecs.version": "1.6.0",
  "log.level": "info",
  "log.origin.file.line": 48,
  "log.origin.file.name": "/path/to/example_test.go",
  "log.origin.function": "go.elastic.co/ecslogrus_test.ExampleFoo",
  "message":"hello"
}
```


## Step 3: Configure Filebeat

<tab-set>
  <tab-item title="Log file">
    1. Follow the [Filebeat quick start](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/beats/filebeat/filebeat-installation-configuration)
    2. Add the following configuration to your `filebeat.yaml` file.
    For Filebeat 7.16+
    ```yaml
    filebeat.inputs:
    - type: filestream 
      paths: /path/to/logs.json
      parsers:
        - ndjson:
          overwrite_keys: true 
          add_error_key: true 
          expand_keys: true 

    processors: 
      - add_host_metadata: ~
      - add_cloud_metadata: ~
      - add_docker_metadata: ~
      - add_kubernetes_metadata: ~
    ```
    For Filebeat < 7.16
    ```yaml
    filebeat.inputs:
    - type: log
      paths: /path/to/logs.json
      json.keys_under_root: true
      json.overwrite_keys: true
      json.add_error_key: true
      json.expand_keys: true

    processors:
    - add_host_metadata: ~
    - add_cloud_metadata: ~
    - add_docker_metadata: ~
    - add_kubernetes_metadata: ~
    ```
  </tab-item>

  <tab-item title="Kubernetes">
    1. Make sure your application logs to stdout/stderr.
    2. Follow the [Run Filebeat on Kubernetes](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/beats/filebeat/running-on-kubernetes) guide.
    3. Enable [hints-based autodiscover](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/beats/filebeat/configuration-autodiscover-hints) (uncomment the corresponding section in `filebeat-kubernetes.yaml`).
    4. Add these annotations to your pods that log using ECS loggers. This will make sure the logs are parsed appropriately.

    ```yaml
    annotations:
      co.elastic.logs/json.overwrite_keys: true 
      co.elastic.logs/json.add_error_key: true 
      co.elastic.logs/json.expand_keys: true 
    ```
  </tab-item>

  <tab-item title="Docker">
    1. Make sure your application logs to stdout/stderr.
    2. Follow the [Run Filebeat on Docker](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/beats/filebeat/running-on-docker) guide.
    3. Enable [hints-based autodiscover](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/beats/filebeat/configuration-autodiscover-hints).
    4. Add these labels to your containers that log using ECS loggers. This will make sure the logs are parsed appropriately.

    ```yaml
    labels:
      co.elastic.logs/json.overwrite_keys: true 
      co.elastic.logs/json.add_error_key: true 
      co.elastic.logs/json.expand_keys: true 
    ```
  </tab-item>
</tab-set>

For more information, see the [Filebeat reference](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/beats/filebeat/configuring-howto-filebeat).