[FEATURE] Elastic.Serilog.Sinks - Allow specifying a formatter for the message string

[am-zq]

ECS integration/library project(s): Elastic.Serilog.Sinks

Is your feature request related to a problem? Please describe. DateOnly and DateTime objects are formatted in the log message using ambiguous formatting, and it does not seem possible to specify a custom formatter.

Consider the following:

_logger.LogInformation("DateOnly: {@date}", dateTest);
_logger.LogInformation("DateTime: {@datetime}", dateTimeTest);

This results in two documents in ElasticSearch with the following strings in the message property:

DateOnly: 01/03/2003 DateTime: 01/03/2003 23:59:59

This could be either dd/mm or mm/dd (and perhaps which one it is varies depending on the locale of the system where I am running my application). I would like dates to be formatted in ISO 8601 for consistency and to facilitate further analysis of log messages from ElasticSearch.

For comparison, with the Serilog Console logger I can pass in a custom formatter:

.WriteTo.Console(
        formatProvider: new ISO8601DateFormatter(),
        ...

The logs are rendered according to the formatter:

DateOnly: 2003-01-03 DateTime: 2003-01-03 23:59:59

Describe the solution you'd like Allow passing in a formatProvider like the other Serilog sinks do

Describe alternatives you've considered

• Expanding the documents in Kibana to look at the fields corresponding to the date/datetimes (the fields are rendered in ISO 8601), however this is very time consuming
• Possibly switching to Serilog.Sinks.Elasticsearch since this appears to support the formatProvider

[am-zq]

I think this is the relevant line: https://github.com/elastic/ecs-dotnet/blob/eac06c3df532d33c1889cca7dca388216c945dc4/src/Elastic.CommonSchema.Serilog/LogEventConverter.cs#L52

RenderMessage is this method of Serilog LogEvent: public string RenderMessage(IFormatProvider? formatProvider = null)

I suspect that passing in a IFormatProvider here (instead of null) would work. Perhaps include IFormatProvider in IEcsTextFormatterConfiguration? Then it could be set on ElasticsearchSinkOptions.TextFormatting during application start, e.g.

.WriteTo.Elasticsearch(
                new[] { new Uri(elasticUri) },
                opts =>
                {
                    opts.DataStream = new DataStreamName("logs", envName, "IBDataService");
                    opts.BootstrapMethod = BootstrapMethod.Failure;
                    opts.TextFormatting = new EcsTextFormatterConfiguration
                    {
                        FormatProvider = new ISO8601DateFormatter(),
                    };
                });

Does this approach seem reasonable?

[kudmax]

I also find this feature missing quite a lot. And it stops me from moving my projects to new library Elastic.Serilog.Sinks.

[Mpdreamz]

Thank you for raising this, opened #449 to implement this! 👍