serilog-sinks-elasticsearch
serilog-sinks-elasticsearch copied to clipboard
Fields are not written at the root of the json document when ElasticsearchSinkOptions.InlineFields is true
Does this issue relate to a new feature or an existing bug?
- [x] Bug
- [ ] New Feature
What version of Serilog.Sinks.Elasticsearch is affected? Please list the related NuGet package. 8.4.1
What is the target framework and operating system? See target frameworks & net standard matrix.
- [ ] netCore 2.0
- [ ] netCore 1.0
- [ ] 4.7
- [x] 4.6.x
- [ ] 4.5.x
Please describe the current behavior? Fields are not written at the root of the json document when ElasticsearchSinkOptions.InlineFields is true
Please describe the expected behavior? Fields are written at the root of the json document when ElasticsearchSinkOptions.InlineFields is true
If the current behavior is a bug, please provide the steps to reproduce the issue and if possible a minimal demo of the problem Configure Serilog like this and call Log.Information:
var loggerConfig = new LoggerConfiguration()
.WriteTo.Elasticsearch(
new ElasticsearchSinkOptions(new Uri("https://elastic-url:9200"))
{
InlineFields = true,
AutoRegisterTemplate = true,
AutoRegisterTemplateVersion = AutoRegisterTemplateVersion.ESv7,
IndexFormat = "test-{0:yyyy.MM.dd}",
CustomFormatter = new ExceptionAsObjectJsonFormatter(renderMessage: true),
BatchPostingLimit = 50,
MinimumLogEventLevel = LogEventLevel.Debug,
ModifyConnectionSettings = configuration =>
configuration.BasicAuthentication("user", "password")
})
.Enrich.WithThreadId();
Log.Logger = loggerConfig.CreateLogger();
var test = "December";
Log.Information("Serilog based log created successfully! {TestField}", test);
and in Kibana I got:
{
"_index": "test-2020.12.07",
"_type": "_doc",
"_id": "J3MIO3YBktaATMP94vP9",
"_version": 1,
"_score": null,
"_source": {
"@timestamp": "2020-12-07T09:30:04.7683484+07:00",
"level": "Information",
"messageTemplate": "Serilog based log created successfully! {TestField}",
"message": "Serilog based log created successfully! \"December\"",
"fields": {
"TestField": "December",
"ThreadId": 1
}
},
"fields": {
"@timestamp": [
"2020-12-07T02:30:04.768Z"
]
},
"sort": [
1607308204768
]
}
but from InlineFields description I expect json like this:
{
"_index": "test-2020.12.07",
"_type": "_doc",
"_id": "J3MIO3YBktaATMP94vP9",
"_version": 1,
"_score": null,
"_source": {
"@timestamp": "2020-12-07T09:30:04.7683484+07:00",
"level": "Information",
"messageTemplate": "Serilog based log created successfully! {TestField}",
"message": "Serilog based log created successfully! \"December\"",
"TestField": "December",
"ThreadId": 1
},
"fields": {
"@timestamp": [
"2020-12-07T02:30:04.768Z"
]
},
"sort": [
1607308204768
]
}
Did you write to root? I have the same problem.
I seem to have the same problem, I use some enrichments which are placed in de fields.* within elastic. They keep being written there even though I have set InlineFields = true in the options. Is there any view on this issue? Or am I perhaps using a wrong configuration?
Thanks!
I have found that if you are using a custom formatter, you need to set Inlinefields in the formatter otherwise it won't work. Hope this helps.
Ah! Neat! Thanks, I got it working!
I have same issue.