serilog-sinks-elasticsearch icon indicating copy to clipboard operation
serilog-sinks-elasticsearch copied to clipboard

Fields are not written at the root of the json document when ElasticsearchSinkOptions.InlineFields is true

Open Biocomando opened this issue 4 years ago • 5 comments

Does this issue relate to a new feature or an existing bug?

  • [x] Bug
  • [ ] New Feature

What version of Serilog.Sinks.Elasticsearch is affected? Please list the related NuGet package. 8.4.1

What is the target framework and operating system? See target frameworks & net standard matrix.

  • [ ] netCore 2.0
  • [ ] netCore 1.0
  • [ ] 4.7
  • [x] 4.6.x
  • [ ] 4.5.x

Please describe the current behavior? Fields are not written at the root of the json document when ElasticsearchSinkOptions.InlineFields is true

Please describe the expected behavior? Fields are written at the root of the json document when ElasticsearchSinkOptions.InlineFields is true

If the current behavior is a bug, please provide the steps to reproduce the issue and if possible a minimal demo of the problem Configure Serilog like this and call Log.Information:

            var loggerConfig = new LoggerConfiguration()
                .WriteTo.Elasticsearch(
                    new ElasticsearchSinkOptions(new Uri("https://elastic-url:9200"))
                    {
                        InlineFields = true,
                        AutoRegisterTemplate = true,
                        AutoRegisterTemplateVersion = AutoRegisterTemplateVersion.ESv7,
                        IndexFormat = "test-{0:yyyy.MM.dd}",
                        CustomFormatter = new ExceptionAsObjectJsonFormatter(renderMessage: true),
                        BatchPostingLimit = 50,
                        MinimumLogEventLevel = LogEventLevel.Debug,
                        ModifyConnectionSettings = configuration =>
                            configuration.BasicAuthentication("user", "password")
                    })
                .Enrich.WithThreadId();
            Log.Logger = loggerConfig.CreateLogger();
            var test = "December";
            Log.Information("Serilog based log created successfully! {TestField}", test);

and in Kibana I got:

{
  "_index": "test-2020.12.07",
  "_type": "_doc",
  "_id": "J3MIO3YBktaATMP94vP9",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2020-12-07T09:30:04.7683484+07:00",
    "level": "Information",
    "messageTemplate": "Serilog based log created successfully! {TestField}",
    "message": "Serilog based log created successfully! \"December\"",
    "fields": {
      "TestField": "December",
      "ThreadId": 1
    }
  },
  "fields": {
    "@timestamp": [
      "2020-12-07T02:30:04.768Z"
    ]
  },
  "sort": [
    1607308204768
  ]
}

but from InlineFields description I expect json like this:

{
  "_index": "test-2020.12.07",
  "_type": "_doc",
  "_id": "J3MIO3YBktaATMP94vP9",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2020-12-07T09:30:04.7683484+07:00",
    "level": "Information",
    "messageTemplate": "Serilog based log created successfully! {TestField}",
    "message": "Serilog based log created successfully! \"December\"",
    "TestField": "December",
    "ThreadId": 1
  },
  "fields": {
    "@timestamp": [
      "2020-12-07T02:30:04.768Z"
    ]
  },
  "sort": [
    1607308204768
  ]
}

Biocomando avatar Dec 07 '20 02:12 Biocomando

Did you write to root? I have the same problem.

italocassio avatar May 25 '21 13:05 italocassio

I seem to have the same problem, I use some enrichments which are placed in de fields.* within elastic. They keep being written there even though I have set InlineFields = true in the options. Is there any view on this issue? Or am I perhaps using a wrong configuration?

Thanks!

keeshus avatar Aug 16 '22 07:08 keeshus

I have found that if you are using a custom formatter, you need to set Inlinefields in the formatter otherwise it won't work. Hope this helps.

KeyDecoder avatar Sep 01 '22 04:09 KeyDecoder

Ah! Neat! Thanks, I got it working!

keeshus avatar Sep 01 '22 05:09 keeshus

I have same issue.

vinibeloni avatar Sep 11 '22 19:09 vinibeloni