Open nenadvicentic opened 1 year ago
Currently, using Serilog.Sinks.Elasticsearch v9.0.0
, it is possible to integrate Elastic.CommonSchema.Serilog.EcsTextFormatter
using the customFormatter
options, as shown in the extract of appsettings.json
bellow:
{
// ....
"Serilog": {
"Using": [ "Serilog.Sinks.Elasticsearch" ],
"MinimumLevel": "Information",
"WriteTo": [
{
"Name": "Elasticsearch",
"Args": {
"nodeUris": "http://localhost:9200",
"customFormatter": "Elastic.CommonSchema.Serilog.EcsTextFormatter, Elastic.CommonSchema.Serilog"
}
}
],
"Enrich": [ "FromLogContext", "WithMachineName" ],
"Properties": {
"Application": "My app"
}
},
// ...
}
However, it turned out that current version of Elastic.CommonSchema.Serilog.EcsTextFormatter
from Elastic.CommonSchema.Serilog
NuGet package v1.5.3
only works with Elasticsearch server v8.x
! It breaks logging when pointed to Elasticsearch server versions lower than 8. With it's default formatter Serilog.Sinks.Elasticsearch v9.0.0
works against Elasticsearch server major versions 6, 7 and 8.
A few questions before you begin:
Does this issue relate to a new feature or an existing bug?
What version of Serilog.Sinks.Elasticsearch is affected? Please list the related NuGet package. 9.0.0-alpha-*
What is the target framework and operating system? See target frameworks & net standard matrix.
As a part of integration effort between .NET and Elasticsearch, Elastic team provides Elastic Common Schema .NET repository which includes two sub-projects:
esc-*
index templates.Serilog.Formatting.ITextFormatter
implementation in the form ofElastic.CommonSchema.Serilog.EcsTextFormatter
, for easy integration with Serilog:The issue is a follow-up to #254 and #227, containing more up-to-date information and first look at the integration.
Simple experiment with naïve
Serilog.Sinks.Elasticsearch
integration, whereEcsTextFormatter
simply replaces current default formaterElasticsearchJsonFormatter
:...produces following output in Elasticsearch/Kibana v8.6.0:
Open questions would be:
EcsTextFormatter
settings work just fine with Elasticsearch, using dynamic fields mapping, without any template registration)? Full implementation, with parity of features is something that would probably take a lot of rewrite effort and testing.