Using Serilog.Sinks.Splunk when Network Connectivity Might Be Unavailable or Metered at Times?

[mesheets]

As Serilog.Sinks.Splunk has a dependency on Serilog.Sinks.Periodic batching, a related issue (#49) has also been submitted under Serilog.Sinks.PeriodicBatching.

What might be a "best practice" approach for using Serilog.Sinks.Splunk when the device that is running the software from which the logs are collected might be offline and/or on a metered connection for substantial portions of time? Ideally, logs would only be forwarded to Splunk when on an unmetered connection.

In looking at the code, Serilog.Sinks.Splunk.EventCollectorSink inherits from Serilog.Sinks.PeriodicBatching.PeriodicBatchingSink.

In turn, Serilog.Sinks.PeriodicBatching.PeriodicBatchingSink instantiates a captive instance of the non-public class Serilog.Sinks.PeriodicBatching.BatchedConnectionStatus (e.g. no opportunity to inject an alternative implementation).

Several values within BatchConnectionStatus appear to be hard-coded, including the following:

• MinimumBackoffPeriod
• MaximumBackoffInterval
• FailuresBeforeDroppingBatch
• FailuresBeforeDroppingQueue

I understand reasons and use cases for backoff logic, but in scenarios with part of the time spent in offline or metered connectivity, a backoff scenario that is also dropping batches and queues would not be desirable. (Also, logs aren't the only data, being collected, and backend systems are designed for the type of usage in question.)

The following perhaps might be a ways to enable such capability with minimal disturbance to the existing code base, but might others more familiar with the code have other suggestions?

• Splunk.EventCollectorSink appears to be using an obsolete constructor of its parent PeriodicBatchingSink; update Splunk.EventCollectorSink to be able to accept and pass through to PeriodicBatchingSink an instance of PeriodicBatchingSyncOptions.
  • Add the following properties to PeriodicBatchingSinkOptions:
  • MinimumBackoffPeriod : also provide a way to disable?
  • MaximumBackoffInterval : also provide a way to disable?
  • FailuresBeforeDroppingBatch : also provide a way to disable?
  • FailuresBeforeDroppingQueue : also provide a way to disable?
  • ShouldAttempt: this would be a lambda expression that would evaluate to a Boolean and would facilitate providing a custom set of criteria to use in determining whether or not to attempt to connect (e.g. if offline or on a metered connection, don't attempt).
  • Update PeriodicBatchingSink.OnTick() to evaluate ShouldAttempt before executing the try/catch block that currently exists.

[merbla]

Closing as a part of larger Serilog contrib reorg

Checkout serilog/serilog#1627