SIEM logging (ECS-JSON)

NodePilot can emit application logs and audit events as Elastic Common Schema 1.x. The ECS-JSON format suits Elastic Filebeat, Splunk HEC, Microsoft Sentinel and other SIEM systems with structured JSON ingest. Both event kinds use the same Serilog pipeline.

Enabling it

"Logging": { "Format": "ecs-json" }

Wire format

One event per line, \n-terminated. Reserved ECS fields:

{
  "@timestamp": "2026-05-08T22:34:11.482Z",
  "log.level": "info",
  "message": "Workflow execution started",
  "ecs.version": "1.12.0",
  "nodepilot": {
    "workflow_id": "...",
    "execution_id": "...",
    "step_id": "step-7",
    "duration": 1234
  }
}

NodePilot domain properties land under nodepilot.* (PascalCase → snake_case). Properties with an ECS prefix (event., user., source., service., host., error., trace., http., url., network. …) are lifted to the JSON root in their nested ECS form.

Duplicate-key deduplication: two source names that normalize to the same snake_case target are deduplicated last-wins — this prevents rejections in strict ingest pipelines.

Audit events on the SIEM stream

Every successful audit row is additionally emitted as a structured ECS event:

Out-of-the-box Sigma/Sentinel/Elastic detection rules match without custom field mapping. Failing audit writes are logged as well (at error level with an error block), so that a silently dropped audit row becomes operationally visible.

Filebeat example

These examples read only the dated main logs nodepilot-[0-9]*.log in JSON/ECS format. nodepilot-support-*.log is always plain text and must not be passed to the NDJSON parser. Adapt the pattern if you customize Logging:File:Path.

filebeat.inputs:
  - type: filestream
    id: nodepilot
    paths:
      - C:\ProgramData\NodePilot\logs\nodepilot-[0-9]*.log
    parsers:
      - ndjson:
          target: ""
          add_error_key: true
processors:
  - timestamp:
      field: "@timestamp"
      layouts: ["2006-01-02T15:04:05.999999999Z07:00"]
output.elasticsearch:
  hosts: ["es.example.com:9200"]
  index: "nodepilot-%{+yyyy.MM.dd}"

Splunk

Use Splunk Universal Forwarder to monitor ECS JSON log files. Filebeat has no generic HTTP output. Configure the receiver and TLS using your Splunk deployment's approved outputs.conf, then add this inputs.conf stanza:

[monitor://C:\ProgramData\NodePilot\logs\nodepilot-*.log]
disabled = 0
whitelist = nodepilot-[0-9].*\.log$
index = nodepilot
sourcetype = _json

Create/authorize the nodepilot index, grant the forwarder read access to the log directory, restart it, and verify a synthetic event in the receiver. This uses Splunk forwarding, not HEC. If HEC is mandatory, select a collector with explicit Splunk HEC support and validate its event envelope and TLS settings.

Splunk: inputs.conf · Splunk: forwarder configuration

Operator checklist

• Logging:Format=ecs-json in appsettings.Production.json.
• A collector such as Filebeat, Vector, Fluentd or Splunk Universal Forwarder is installed alongside the NodePilot service.
• The log file path matches Logging:File:Path (production: C:\ProgramData\NodePilot\logs\nodepilot-.log).
• One sample event indexed end to end in the SIEM (smoke test).
• At least one dashboard panel created on nodepilot.execution_id.

Out of scope

An audit outbox push pipeline (V2), CEF/LEEF, a syslog sink (which can be added through Filebeat or Serilog.Sinks.Syslog).