This slog handler makes structured ECS logging easier with slog by accepting the dot notation (event.action) and producing corresponding nested JSON objects. This approach eliminates the need for nested grouping when constructing the log attributes.

For details see documentation.

• deduplication of scalar attributes
• downstream log instances can set attribute in "group" created upstream
• it has comparable performance to slog.NewJSONHandler()

The implementation has very similar performance to slog.NewJSONHandler(), based on some local testing with zap benchmark.

logger := slog.New(ecslog.NewHandler(os.Stderr)).
    With(
        slog.String("event.dataset", "testing"),
        slog.String("log.logger", "slog"),
    )
// ...
logger.Info("Test!",
    slog.String("event.action", "test"),
)
// {
//   "@timestamp": "2026-01-11T17:00:42.42648+01:00",
//   "message": "Test!",
//   "log": {
//     "logger": "slog",
//     "level": "INFO"
//   },
//   "event": {
//     "dataset": "testing",
//     "action": "test"
//   }
// }