serilog-contrib / serilog-sinks-splunk

A Serilog sink that writes to Splunk
https://splunk.com
Apache License 2.0
46 stars 47 forks source link

The event collector ignores the outputTemplate #64

Closed JaimeReynoso closed 6 years ago

JaimeReynoso commented 7 years ago

The event collector ignores the output template option. It does not render the output template specified

merbla commented 7 years ago

Hi @JaimeReynoso,

Do you have a quick repo of the problem

Thanks!

merbla commented 7 years ago

Hi @JaimeReynoso,

Any chance for some code to repo the problem?

eaardal commented 6 years ago

Hi I see the same problem. You can use the test-repo I used for playing with this: https://github.com/eaardal/SerilogDemo/tree/output-template

Code:

            const string outputTemplate =
@"=== Meta ===
Timestamp=""{Timestamp}""
Level=""{Level}""

=== Context ===
Application=""{Applikasjon}""
ThreadId=""{ThreadId}""

=== Message ===
{Message}
";

            var loggerConfiguration = new LoggerConfiguration();

            loggerConfiguration
                .Enrich.With(new ThreadIdEnricher())
                .Enrich.WithProperty("Application", "MyApp")
                .WriteTo.ColoredConsole(outputTemplate: outputTemplate)
                .WriteTo.EventCollector("http://localhost:8088/", "b9543dee-981a-4175-a3e9-963bbcebf677", outputTemplate: outputTemplate)
                ;

Result I see in Splunk vs template I see in console

serilog_splunk_outtemp

gabrielweyer commented 6 years ago

Structured Sinks don't support outputTemplate. If you look at SplunkLoggingConfigurationExtensions you'll see than the parameter outputTemplate is never used.

It makes sense to remove the outputTemplate parameter, thoughts?

eaardal commented 6 years ago

Yeah if it's not supported it shouldn't look like it is imo. Either remove or mark as [Obsolete] with explanation?

merbla commented 6 years ago

Removing FTM, however using the raw endpoint would allow this to be a use case.