A formatter for the morgan logger compatible with Elastic Common Schema.

Usage no npm install needed!

<script type="module">
  import elasticEcsMorganFormat from 'https://cdn.skypack.dev/@elastic/ecs-morgan-format';



Build Status js-standard-style

This Node.js package provides a formatter for the morgan logging middleware compatible with Elastic Common Schema (ECS) logging.
In combination with the filebeat shipper, you can send your logs directly to Elasticsearch and leverage Kibana's Logs app to inspect all logs in one single place.

Please see the Node.js ECS morgan documentation.


npm install @elastic/ecs-morgan-format


const app = require('express')()
const morgan = require('morgan')
const ecsFormat = require('@elastic/ecs-morgan-format')


app.get('/', function (req, res) {
  res.send('hello, world!')


Running this script and making a request (via curl -i localhost:3000/) will produce log output similar to the following:

% node examples/express.js | jq .  # piping to jq for pretty-printing
  "@timestamp": "2021-01-16T00:03:23.279Z",
  "log.level": "info",
  "message": "::1 - - [16/Jan/2021:00:03:23 +0000] \"GET / HTTP/1.1\" 200 13 \"-\" \"curl/7.64.1\"",
  "ecs": {
    "version": "1.6.0"
  "http": {
    "version": "1.1",
    "request": {
      "method": "GET",
      "headers": {
        "host": "localhost:3000",
        "accept": "*/*"
    "response": {
      "status_code": 200,
      "headers": {
        "x-powered-by": "Express",
        "content-type": "text/html; charset=utf-8",
        "etag": "W/\"d-HwnTDHB9U/PRbFMN1z1wps51lqk\""
      "body": {
        "bytes": 13
  "url": {
    "path": "/",
    "domain": "localhost",
    "full": "http://localhost:3000/"
  "user_agent": {
    "original": "curl/7.64.1"

Please see the Node.js ECS morgan documentation for more.


This software is licensed under the Apache 2 license.