Serilog.Sinks.Network
Serilog.Sinks.Network copied to clipboard
A serilog network sink. Designed with logstash and the Elastic stack in mind
Serilog Network Sink
Writes the JSON output from serilog log event to either UDP or TCP
Versions
Serilog Network Sink is targeted NetStandard 1.3 from version 2.x. It can be used for .NET Core based projects.
1.x versions are still targeted to standard .Net Framework 4.5
Usage
Set up to log via TCP
var ip = IPAddress.Parse("1.3.3.7");
var log = new LoggerConfiguration()
.WriteTo.TCPSink(ip, 1337)
.CreateLogger();
var urlLogger = new LoggerConfiguration()
.WriteTo.TCPSink("some.url.com", 1337)
.CreateLogger();
var urlLogger = new LoggerConfiguration()
.WriteTo.TCPSink("tls://some.fqdn.com:12435")
.CreateLogger();
// you can provide any specific formatter ...
var urlLogger = new LoggerConfiguration()
.WriteTo.TCPSink("tls://some.fqdn.com:12435", new RawFormatter())
.CreateLogger();
// ... otherwise this will use the default provided LogstashJsonFormatter (described below)
var urlLogger = new LoggerConfiguration()
.WriteTo.TCPSink("tls://some.fqdn.com:12435")
.CreateLogger();
Or maybe UDP
var ip = IPAddress.Parse("1.3.3.7");
var log = new LoggerConfiguration()
.WriteTo.UDPSink(ip, 1337)
.CreateLogger();
var urlLogger = new LoggerConfiguration()
.WriteTo.UDPSink("some.url.com", 1337)
.CreateLogger();
// you can provide any specific formatter for UDP too ...
var urlLogger = new LoggerConfiguration()
.WriteTo.UDPSink("some.url.com", 1337, new RawFormatter())
.CreateLogger();
Configure from the config file
<add key="serilog:minimum-level" value="Verbose" />
<add key="serilog:using:TCPSink" value="Serilog.Sinks.Network" />
<add key="serilog:write-to:TCPSink.uri" value="192.165.25.55" />
<add key="serilog:write-to:TCPSink.port" value="3251" />
JSON structure (LogstashJsonFormatter)
Serilog log JSON tends to look like this:
{
"Timestamp": "2016-11-03T16:28:55.0094294+00:00",
"Level": "Information",
"MessageTemplate": "ping: {ping} and pong: {pong}",
"message": "ping: 972 and pong: 973",
"Properties": {
"ping": 972,
"pong": 973,
"application": "ping ponger",
"type": "example",
"environment": "production"
}
}
The LogstashJsonFormatter flattens that structure so it is more likely to fit into an existing logstash infrastructure.
{
"timestamp": "2016-11-03T16:28:55.0094294+00:00",
"level": "Information",
"message": "ping: 972 and pong: 973",
"ping": 972,
"pong": 973,
"application": "ping ponger",
"type": "example",
"environment": "production",
}
Acknowledgements
Adapted from Serilog Splunk Sink and Splunk .Net Logging both Apache 2.0 licensed