TL;DR

Spring Boot 3.5 changed the format of the ECS logs.

Detail

According to Spring Boot 3.5 Release Notes,

JSON output for ECS structure logging has been updated to use the nested format. This should improve compatibility with the backends that consume the JSON.

See https://github.com/spring-projects/spring-boot/issues/45063 for background.

Before the ECS format was flat:

{
  "@timestamp": "2025-07-29T14:26:54.338050434Z",
  "ecs.version": "8.11",
  "log.level": "INFO",
  "log.logger": "com.example.MyClass",
  ...
}

From Spring Boot 3.5.0+ the ECS format is nested:

{
  "@timestamp": "2025-07-29T14:26:54.338050434Z",
  "ecs": {
    "version": "8.11"
  },
  "log": {
    "level": "INFO",
    "logger": "com.example.MyClass"
  },
  ...
}

And we had a very simple (a euphemism for stupid 😀) filter in Kibana checking for the ECS log format by testing for the presence of ecs.version.

So after amending the filter everything works OK as before.

Well, I understand that Spring might have some reason behind the change, just why couldn't they make it optional, with the option default value equal the old behaviour? Wasn't the infamous trailing slash breaking change blunder enough?

Unfortunately, I didn't find any parameter which would return the flattened format as was in use before.
If anyone knows how to return back to the flattened structure, please let me know.