datalust / serilog-sinks-seq

A Serilog sink that writes events to the Seq structured log server
https://datalust.co/seq
Apache License 2.0
239 stars 50 forks source link

Convert dotted property names into nested values when Serilog v4's experimental `AppContext` switch is set #223

Closed nblumhardt closed 5 months ago

nblumhardt commented 5 months ago

This is experimental functionality not intended for production use. It helps prepare for the possible introduction of . into property names, which Serilog v4 will enable behind a feature flag:

AppContext.SetSwitch("Serilog.Parsing.MessageTemplateParser.AcceptDottedPropertyNames", true);

Log.Information("Running loop {Counter.I}, switch is at {Level}", i, levelSwitch.MinimumLevel);

The sink could transmit these to Seq as-is, but the query ergonomics for dotted names in Seq is poor (@Properties['Some.Name']), so they're converted client-side into structured data.

Seq handles the resulting structured property values, but cannot render these in templates - something this PR may help pave the way for in the future.

image

Lots of exploration and testing required around properties with partially-overlapping names, pre-rendered substitutions (format strings), etc. etc. :-)

See also https://github.com/serilog/serilog/pull/2063

wjrogers commented 5 months ago

This has already been implemented, but I still want to chime in because I haven't seen anyone mention OpenTelemetry in the discussion of dotted property names in Serilog and Seq. Seq supports OpenTelemetry traces, now, which has been a real boon for adding span-based tracing to our existing logging infrastructure. It also supports dotted span attribute names, including automatic accordion-style display:

image

I am interested in aligning property/attribute names across our logs and traces, so e.g. searching for a job ID finds both kinds of data. OpenTelemetry strongly encourages "namespaced" dotted names, but it was previously cumbersome (and inefficient) to do the same with Serilog. It looks like this new feature will make it much easier. Please keep this use case in mind as you consider whether to support dotted names in Serilog in the future!