Change field name prefix from "payload."

[BuddhaBuddy1]

Is it possible to change the field name prefix from "payload." to something else?

[karolz-ms]

Can you elaborate? Are you referring to a specific output, or input-output combination?

[BuddhaBuddy1]

When I look at logs in ELK, the field names I add are all prefixed with "payload.".

I don't have Payload in my code or configuration anywhere. As far as I can tell, that is coming from this library. It uses "Payload" as the name of the variable that contains everything that is going to be logged.

[karolz-ms]

Correct, the name payload comes from the EventData class definition: https://github.com/Azure/diagnostics-eventflow/blob/master/src/Microsoft.Diagnostics.EventFlow.Core/Implementations/EventData.cs#L30. Basically, there is only a few top-level properties define for this class, and all the per-event-type data goes into the Payload dictionary.

I am afraid there is no out-of-the-box way to change this. You could use a custom serializer to change how EventData object are converted to JSON before being stored in Elasticsearch, but EventFlow Elasticsearch output currently does not expose a way to set up a custom serializer for event data; this is something that would have to be added.