Open am-zq opened 1 year ago
I think this is the relevant line: https://github.com/elastic/ecs-dotnet/blob/eac06c3df532d33c1889cca7dca388216c945dc4/src/Elastic.CommonSchema.Serilog/LogEventConverter.cs#L52
RenderMessage is this method of Serilog LogEvent:
public string RenderMessage(IFormatProvider? formatProvider = null)
I suspect that passing in a IFormatProvider here (instead of null) would work. Perhaps include IFormatProvider in IEcsTextFormatterConfiguration
? Then it could be set on ElasticsearchSinkOptions.TextFormatting
during application start, e.g.
.WriteTo.Elasticsearch(
new[] { new Uri(elasticUri) },
opts =>
{
opts.DataStream = new DataStreamName("logs", envName, "IBDataService");
opts.BootstrapMethod = BootstrapMethod.Failure;
opts.TextFormatting = new EcsTextFormatterConfiguration
{
FormatProvider = new ISO8601DateFormatter(),
};
});
Does this approach seem reasonable?
I also find this feature missing quite a lot. And it stops me from moving my projects to new library Elastic.Serilog.Sinks.
ECS integration/library project(s): Elastic.Serilog.Sinks
Is your feature request related to a problem? Please describe. DateOnly and DateTime objects are formatted in the log message using ambiguous formatting, and it does not seem possible to specify a custom formatter.
Consider the following:
This results in two documents in ElasticSearch with the following strings in the
message
property:This could be either dd/mm or mm/dd (and perhaps which one it is varies depending on the locale of the system where I am running my application). I would like dates to be formatted in ISO 8601 for consistency and to facilitate further analysis of log messages from ElasticSearch.
For comparison, with the Serilog Console logger I can pass in a custom formatter:
The logs are rendered according to the formatter:
Describe the solution you'd like Allow passing in a formatProvider like the other Serilog sinks do
Describe alternatives you've considered